chore: public OSS release 2.8.1

[rng1995]

Summary

Publishes the sanitized SkillSpector 2.8.1 OSS snapshot.

Highlights

• Adds provider-reported inference usage telemetry to JSON scan reports, with model provenance, cache accounting, strict field allowlisting, and no pricing assumptions.
• Retries malformed structured LLM responses once and isolates persistent validation failures to the affected batch.
• Excludes the explicitly selected baseline or baseline output from scan content while leaving sibling files in scope.
• Hardens PE3 token-access detection and semantic analyzer/reporting behavior.
• Includes the public release notes and changelog entries through 2.8.1.

Source and release boundary

• Internal release source: 589281bf188f28eb59d7db8fe10858612b5f3d1f
• Internal sanitized branch: release/oss-2026-08-06
• Sanitized orphan commit: 1c2a3cdf310644b3c89ebcb134aa681b9ed5b6e3
• Public snapshot commit: 79a0f44a3674748bdbb0eed2535eab8c647d92ed
• Released version: 2.8.1
• Release notes: docs/release/skillspector-2.8.1.md

Internal-only provider, CI, release, Sonar, planning, and automation paths were excluded by the repository scrubber. The reviewed public diff deletes no GitHub-only files and does not alter the existing GitHub workflows. Public telemetry examples use the public Anthropic provider and model identifiers.

Verification

• make test-unit — 1,911 passed, 13 skipped, 38 deselected, and 4 xfailed.
• git diff --cached --check — passed after removing one scrubber-generated trailing blank line.
• Committed-tree private host/project reference scan — clean.
• release/2.8.1 and the internal release bump both resolve to 589281bf188f28eb59d7db8fe10858612b5f3d1f.

Public GitHub checks are expected to run on this PR.