v0.1.6 — mutating-tool gate, readable latency, honest verdict

Behavioural change. passed now requires score >= pass_score AND no failed check. A scan that reported PASS at 0.1.5 can report FAIL at 0.1.6 with an unchanged score. Weights, thresholds and the 0-100 scale did not move.

Mutating-tool gate. Auto-selection previously picked the first tool in the discovery list and invoked it for real. Against a knowledge-graph server that meant create_entities, called under fault injection, with only a warning. Auto-selection now requires readOnlyHint=True or a read-only name pattern; UNKNOWN refuses alongside MUTATING. Explicit --tool on a mutating tool requires --allow-mutating. destructiveHint is recorded but not gated on.

Readable sub-second latency. p95 0.00s was a real 0.73ms measurement formatted into something indistinguishable from a missing value, including one comparison that rendered as p95 rose to 0.00s from 0.00s. Durations under 10ms now render in milliseconds.

Provenance in artifacts. Reports and AGENTS.md state blocks now record Probe tool and Probe arguments, so a saved scan says what produced its numbers.

Known limitations: --uri supports stdio:// and sse:// only; Streamable HTTP is not yet supported. Argument synthesis can produce semantically empty calls against tools with required array or object fields. Caller-strategy behaviour metrics are not meaningful against bare server targets.

665 tests.