ship: bump BINARY_VERSION to firefox-9 + refuse the broken firefox-8 (audit B5)

firefox-9 is published (build 5/5, drive-gate 5/5, full e2e 137/1-skip, fppro
ALL CRITICAL CLEAN, WebRTC real, sha256-verified download path). Point the
wrapper at it.

Guard: ensure_binary() now refuses any version in BROKEN_VERSIONS (={firefox-8})
with a clear error instead of handing over an undrivable binary — a cached
firefox-8 from before this bump would otherwise keep being used silently. Tests:
the current BINARY_VERSION can never be in BROKEN_VERSIONS; firefox-8 stays
flagged; ensure_binary("firefox-8") raises.

tests/test_download.py

@@ -832,3 +832,11 @@ def test_parse_owner_repo_handles_repos_with_dashes_and_underscores():
     )
     assert owner == "my-org"
     assert repo == "my_cool.repo"
+
+
+@pytest.mark.unit
+def test_ensure_binary_refuses_known_broken_version():
+    """A known-broken release (firefox-8, no juggler) must be refused with a
+    clear error BEFORE any download — never silently handed to the user."""
+    with pytest.raises(RuntimeError, match="known-broken"):
+        ensure_binary("firefox-8")