release: 1.9.5: GHCR release fix: keep per-arch images, sweep orphaned versions (CI only)

CI-only cut. The release workflow deleted the X.Y.Z-amd64 / X.Y.Z-arm64
package versions after the manifest merge; those versions are the images the
X.Y.Z manifest points at, so pulling 1.3.0 failed with a missing manifest.
No product code changes.

Fixed:
  - release.yml: the per-arch tags stay in GHCR. GHCR cannot drop a tag
    without deleting the image behind it.
  - release.yml: the merge job now removes only untagged package versions
    that no tagged manifest references (leftovers of publishing a version
    again); any failed lookup aborts the step before anything is deleted.
  - development.md release description and version table, image pin 1.9.5
    in compose, README, guide.

Full detail: CHANGELOG.md (1.9.5).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,19 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+## [1.9.5] - 2026-10-09
+
+CI-only cut: the release workflow no longer breaks the multi-arch image it
+just published. No product code changes.
+
+### Fixed
+
+- ci (GHCR): the release no longer deletes the `X.Y.Z-amd64` / `X.Y.Z-arm64`
+  package versions after the manifest merge. Those versions are the images the
+  `X.Y.Z` manifest points at, so `docker pull ghcr.io/mixeme/selfpost:1.3.0`
+  failed with a missing manifest. The per-arch tags now stay; the merge job
+  instead removes untagged versions that no tagged manifest references.
+
 ## [1.9.4] - 2026-10-09
 
 Plan-only cut, owner-requested: the redesign goes first as `2.0.0` with a