v1.6.0 — Wave 1 hardening

Wave 1: cross-runtime metadata + SSRF hardening + sanitize_error scrubber

Bridge release between v1.5.x (commercial-toolkit positioning) and v1.7.x Wave 2.

Highlights

• Cross-runtime metadata refresh (Claude Code, Codex CLI, Cursor, Windsurf, Gemini CLI, Goose)
• Trigger phrase expansion for sub-skill routing
• SSRF guard strengthening: IPv6 ::/128 unspecified address blocked, blocklist documented per CIDR with rationale
• New sanitize_error() scrubber redacts API keys / tokens / Bearer headers from any exception before it reaches stdout
• Distribution metadata refresh (.claude-plugin/, CITATION.cff, README badges)

Full changelog