Lemonade v11.9.0: origin hardening, and upstream took our HRX backend
The embedded Lemonade server core is re-vendored to v11.9.0 — allowed_origins/CORS hardening, llama.cpp to b10723, the streaming-stall fix. Upstream now carries the HRX backend we built, so the re-vendor collapsed to a clean merge: we dropped our stream_stall_timeout and kept the newer hrx-b66 pin.