v0.8.2

Added

• Published container images — GHCR workflow builds and pushes both the
  minimal and full (9-scanner) images on every release (ghcr.io/skyrxin/ sast-mcp-server:full / :minimal), and builds them on every PR so the
  Dockerfiles can't silently rot. Added a docker-compose.yml for one-command
  HTTP deployment.
• [scanners] pip extra — pip install "sast-mcp-server[scanners]" installs
  the pip-based scanners (bandit, njsscan, semgrep, checkov) in one step.
• Startup scanner-availability log — the server logs Scanners available: N/11 (...) at boot (stderr) so it's immediately clear what's usable.
• Reliability evidence — Codecov coverage badge/upload in CI; a self-scan CI
  job that publishes the SARIF + summary as artifacts (snapshot in
  examples/self-scan/); and scripts/loadtest.py with a CI smoke job that
  load-tests the HTTP transport and ops endpoints. New tests/test_ops.py
  covers the /health /ready /metrics routes and the concurrency cap.
• End-to-end engagement evidence — a full SAST engagement against OWASP crAPI
  driven entirely through the server (full-repo scan benchmarks, closed-loop
  remediation FAIL/PASS verdicts, and a CI policy gate). Published separately as
  a write-up rather than committed to the repo.

Changed

• README install story now leads with the batteries-included container and
  a scanner-availability matrix.

Fixed

• /ready performance — the readiness probe cached its scanner inventory
  (15s TTL) instead of spawning a subprocess per scanner on every request,
  which under load tanked latency (p95 ~9s → ~290ms in the load test).
• compare_baseline now accepts scanner_name="scan_all" — it previously
  rejected the aggregated form that save_baseline and
  evaluate_policy(fail_on_new=True) already accept, making a scan_all
  baseline impossible to diff. Covered by new regression tests.
• Bandit JSON parsing on Linux — added -q so bandit's progress/metric
  lines (emitted to stdout on some platforms) no longer corrupt the JSON output
  we parse.