In releasing coreutils-8.9, I left its gnulib submodule pointing at a private commit that was going to be pushed, pending an ACK... Since a slightly different commit was pushed, coreutils' submodule SHA1 was invalid for a short interval. However, I have pushed my local commit to the new gnulib branch named "coreutils-8.9". With that, anyone cloning coreutils and trying to build from the 8.9 tag *will* get a usable gnulib hierarchy.
Thanks to Eric Blake for noticing so quickly and for the suggestion to push my commit to a branch in gnulib.