Update Ruby from 4.0.6 to 4.0.9 #7324

Heroku's build now warns on every deploy:

There is a more recent Ruby version available for you to use: 4.0.9. The latest version will include security and bug fixes.

We're on 4.0.6. Renovate's PR #7209 tries to do this (to 4.0.8), but it's red on every check. It only changes Dockerfile, Gemfile and Gemfile.lock, while CI's ruby/setup-ruby reads .ruby-version, so the versions disagree. This issue is the complete version of that change.

Files to change (4.0.6 → 4.0.9)

The last Ruby bump, #7154 (4.0.6), is a good template. These are the current pins:

• .ruby-version
• .tool-versions
• Gemfile: ruby "4.0.6"
• Gemfile.lock: the RUBY VERSION section. Run bundle install after switching Ruby rather than editing it by hand.
• Dockerfile: both FROM ruby:4.0.6-alpine lines, the build and final stages
• flake.nix: pkgs."ruby-4.0.6". Check that the pinned nixpkgs has ruby-4.0.9; if it doesn't, say so in the PR and leave it.
• .devcontainer/post-create.sh
• README.md, doc/MAC_SETUP.md, doc/LINUX_SETUP.md, doc/WSL_SETUP.md

Not in scope: bin/setup line 146 (gem install bundler -v 4.0.6) and BUNDLED WITH are the Bundler version, not Ruby, so leave them alone. Also leave form-data 4.0.6 in package-lock.json, which is an unrelated npm package. Tip: git grep -n '4\.0\.6' finds every pin.

How to do it

1. Install 4.0.9 with your version manager (asdf install ruby 4.0.9, rbenv install 4.0.9, or mise).
2. Update the files above, then run bundle install.
3. Run bin/rails spec locally, or at least bundle exec rspec spec/models, plus bin/lint.

Acceptance

• Every CI check is green, including docker, which builds the Dockerfile.
• git grep -n '4\.0\.6' shows no Ruby pins (Bundler and npm hits are fine).
• Close chore(deps): update ruby docker tag #7209 when this merges. Renovate may reopen it for 4.0.9, which is fine as long as it's green.

Maintainers: the Heroku build reads Gemfile's ruby line, so the deploy after merge installs 4.0.9 automatically. Check the build log for Using Ruby version: ruby-4.0.9.