release: v0.94.0 candidate — security tooling + engine/server hardening train; version + internal pins