2026.9.10.1

What's Changed

• feat(ci): report scopes against the pull request head by @sileht in #1794
• refactor(core): split Mergify and GitHub token resolution by @sileht in #1802
• fix(live-tests): move tests show onto the admin token by @jd in #1798
• docs(live-tests): drop the mirror claims for deleted Python files by @jd in #1799
• test(live): cover the quarantine add/remove round-trip by @jd in #1801
• docs(release): add a maintainer skill for cutting a release by @jd in #1795
• fix(ci): skip a test whose name is too large and say which one by @sileht in #1793
• feat(core): store the Mergify credential in the OS keychain by @sileht in #1803
• feat(ci): declare how many uploads make up a test session by @AlexandreGaubert in #1816
• feat(core): let a caller read an endpoint's rejection body by @sileht in #1804
• feat(auth): the device authorization grant, client side by @sileht in #1805
• fix(core): send API requests under the base URL's path prefix by @jd in #1819
• feat(cli): mergify auth login, logout and status by @sileht in #1806

Full Changelog: 2026.8.28.1...2026.9.10.1