v0.6.3

What's Changed

• ci: node 18/20/22/24 matrix with offline fixture scans (BEAAA-28648) by @CorwinFoundation in #18
• Add security policy and fix Agent Scan follow-up link by @CorwinFoundation in #21
• BEAAA-28669 [F2]: lock explain_shell argument-name equivalence in the scored set by @CorwinFoundation in #22
• Release the separately versioned Agent Scan stdio gate by @CorwinFoundation in #24
• BEAAA-30956: add false-positive.yml and link it at the top of README by @CorwinFoundation in #26
• docs: require the disputed rule code on false-positive intake (BEAAA-30942) by @CorwinFoundation in #25
• docs: add browser checker discovery link by @CorwinFoundation in #23
• Fix BB004 read-only write-verb false positive by @CorwinFoundation in #28
• Publish approved Agent Scan article artifacts by @CorwinFoundation in #31
• BEAAA-31862: bump ruleset for BB004 semantics by @CorwinFoundation in #29
• Add Glama listing maintainer metadata by @CorwinFoundation in #33
• docs: add Context7 claim proof and Agent Scan discovery metadata by @CorwinFoundation in #34
• BEAAA-31969: pin ruleset version and digest pair by @CorwinFoundation in #32
• docs: link the 50-second Agent Scan demo by @CorwinFoundation in #35
• BEAAA-29873: declare labels on the false-positive and scan-feedback intake forms by @CorwinFoundation in #37
• BEAAA-33319: land the false-positive response SLA path and name both intake routes by @CorwinFoundation in #38
• docs: Claude Code manifest inspection guide by @CorwinFoundation in #36
• docs: link the Claude Code guide from the README by @CorwinFoundation in #39
• release: prepare 0.6.3 candidate (BEAAA-33509) by @CorwinFoundation in #40

Full Changelog: v0.6.2...v0.6.3