Summary

This bumps the BoxLite SDK patch release metadata to 0.9.1 and includes the Rust consumer packaging fix needed after the v0.9.0 README validation pass.

The SDK-facing version updates are:

• Rust workspace package version and boxlite workspace dependency requirement: 0.9.1
• Cargo lockfile package entries: 0.9.1
• Python SDK package metadata: 0.9.1
• Node SDK package metadata: 0.9.1
• Go SDK patch version is driven by the release workflow tag sdks/go/v${VERSION}, so the workspace release version now drives sdks/go/v0.9.1

Language/runtime constraints are intentionally unchanged: Rust rust-version, Python requires-python, Node engines, and Go go directives were not bumped.

Rust Packaging Fix

The Rust build script now handles consumer builds without relying on source-workspace discovery. Prebuilt-runtime mode embeds the already downloaded runtime directly, and non-primary source dependency builds can fall back to the GitHub release runtime instead of producing an empty embedded runtime or panicking while looking for a workspace root.

The embedded runtime manifest also now carries file modes from the packaged runtime, so extracted binaries and libraries preserve the artifact-defined permissions instead of relying on hard-coded executable-name lists.

Docs

• Simplified the Rust quick-start install command to one cargo add command.
• Updated the Rust getting-started snippet to match the current async API.
• Fixed Node SDK README install/link examples to use @boxlite-ai/boxlite.

Validation

On ssh dev in /tmp/boxlite-sdk-bump-worktree:

• cargo fmt --check
• git diff --check
• cargo pkgid -p boxlite, boxlite-c, boxlite-python, boxlite-node all resolve to 0.9.1
• docs grep confirms the one-line Rust install command and scoped Node package name
• cargo package -p boxlite --allow-dirty --no-verify
• cargo clippy -p boxlite --no-default-features --lib -- -D warnings
• cargo test -p boxlite --no-default-features --lib runtime::embedded::tests::manifest_is_available -- --test-threads=1

Local repository hooks also passed before push:

• pre-commit quality autofix/checks
• pre-push changed-component matrix for Node, Python, and Rust, including VM integration tests

Note: public cargo add boxlite@0.9.1 validation requires the 0.9.1 release artifacts and crates.io package to exist first. This PR prepares the patch release; the release workflow publishes the runtime artifact before publishing the Rust crate.