v0.9.26

Maintenance release. Correctness fixes across Python call-graph inference, the git hook (Windows), and bash source resolution.

Fixes

• graphify query/explain no longer fabricate indirect_call edges to class definitions (#2137, thanks @Rishet11). Passing a class as a value (select(Model), db.get(Model, id), except (ErrorA, ErrorB), getattr(obj, "Name", 0)) produced a false inferred call edge; classes are now excluded from indirect_call in both the intra-file and cross-file paths, while direct instantiation still emits its calls edge.
• The post-commit hook's interpreter allowlist now accepts Windows backslash paths (#2126, thanks @Rishet11). The shell case glob silently emptied any interpreter path containing a backslash, so the hook failed on Windows uv/venv installs. Both allowlist sites use a verified character class that admits backslashes while still rejecting shell metacharacters.
• The hook rebuild timeout is now armed on Windows (#2148, thanks @Rishet11). It relied on signal.SIGALRM, which does not exist on Windows, so GRAPHIFY_REBUILD_TIMEOUT was a silent no-op and a hung rebuild ran unbounded. A threading.Timer fallback now terminates a runaway rebuild where SIGALRM is unavailable; the Unix path is unchanged.
• Bash calls into functions defined in a sourced file now get calls edges (#2141, thanks @HerenderKumar). Resolution was gated on same-file definitions, so a call to a sourced-library function looked like an external command and produced no edge. Both source file and . file are handled; resolution is in-corpus and single-match only, so a genuine external command still fabricates nothing.
• Bash source edges built from a variable path now resolve (#2079, thanks @HerenderKumar). source "${BENCH_DIR}/lib/x.sh" baked the unexpanded ${VAR} into a dead node id; the leading expansion is stripped and the literal suffix resolved against the script's directory, emitted as INFERRED only when it resolves to a real file. Calls into a ${VAR}-sourced library resolve too.
• Ignore files saved with a UTF-8 BOM are now honored (#2163). .gitignore/.graphifyignore/info/exclude were read as utf-8, so a leading BOM stayed on the first line and silently dropped the first pattern. The ignore read sites now use utf-8-sig, matching git.