v0.13.3: Body-excerpt key scrub + org migration

Fixed

• Body excerpts are now scrubbed of the real API key before truncation
  ([REDACTED-KEY]), making SECURITY.md's long-standing claim true. Excerpts
  travel into webhook/Telegram alert payloads and the --json snapshot, so a
  server error echoing the key back would have fanned it out to every
  configured alert channel. Scrub-before-truncate also kills the
  key-straddles-the-200-char-boundary case. Locked by new
  BodyExcerptKeyScrubTests in test_security.py.
• Org migration completed in code: GITHUB_URL (advertised in the
  User-Agent) and the raw URLs in update.sh/update.bat now point at
  Yggdrasil-AI-labs instead of surviving on GitHub's rename redirect from
  the old HiroAlleyCat owner.
• Docs told the truth again: SECURITY.md's self-contradictory "No
  shell=True" bullet now accurately describes the one deliberate
  --exec-on-change shell hook and its env-var data transport. README's
  probe table gains the six rows it was missing (badge-catalog, team-id,
  team-me, and the three member-territories variants), the "32 tests" claim
  is corrected to the ~215 that exist, and the webhook payload example no
  longer claims v0.10.0.

v0.6.3: SECURITY.md catch-up

Summary

Pure documentation release. Brings api-tester to the same documented security posture as the rest of the WDGoWars feeder family (Muninn, Heimdall, wigle-to-wdgwars all carry a SECURITY.md). No behavior changes; the only code touched is the __version__ bump from 0.6.2 to 0.6.3.

What changed

Added

• SECURITY.md: documents the probe's outbound footprint, key handling, --exec-on-change threat model, and alert payload shapes (Telegram + webhook). Lifted from Heimdall's template and adapted for the probe-tool surface — api-tester reads keys but never saves them, and has alert paths the uploaders don't.

Documented (not ported)

The 2026-06-03 family audit checked whether the rest of the 5-piece safety net (scripts/check_readme_examples.py, pages.yml, --setup/--update/--schedule) belonged here too. CHANGELOG records the rationale for each "no":

• README linter is irrelevant for a single-file stdlib-only tool (no PEP-668 venv-form footgun to catch).
• pages.yml publishes the web/ Pyodide frontend Muninn and Heimdall carry; api-tester has no browser surface.
• --setup/--update/--schedule from the uploader family don't fit the probe shape — api-tester reads from the shared family config path and uses --watch for continuous monitoring.

Test plan

• bash scripts/smoke.sh — passes (parse + import + version + help + offline tests + mock-server roundtrip)
• --version reports 0.6.3
• No code changes beyond version bump, so existing test surface still covers behavior

v0.6.2: family-alignment housekeeping

What's Changed

• chore: add CI workflow + PR template by @HiroAlleyCat in #1
• chore: family-alignment housekeeping (CHANGELOG + shims + smoke) by @HiroAlleyCat in #2

New Contributors

• @HiroAlleyCat made their first contribution in #1

Full Changelog: https://github.com/HiroAlleyCat/wdgwars-api-tester/commits/v0.6.2