v0.9.6 — Security + repo hygiene + docs refresh

Patch release with three security fixes, eight Dependabot dev-tool bumps,
input-validation hardening of analysis/koopman.py, repository-hygiene
changes, and a sweep of stale counts across the documentation tree.

Security

• Pytest CVE-2025-71176 — bumped via PR #37 to pytest 9.0.3
  (fixes the /tmp/pytest-of-{user} directory pattern that allows
  local users to cause a denial of service or possibly gain
  privileges on UNIX).
• rand RUSTSEC-2026-0097 — bumped to 0.9.4 in
  scpn_quantum_engine/Cargo.lock (the previous 0.9.2 was unsound
  when a custom log logger calls rand::rng() from inside the
  logger, producing aliased &mut BlockRng).
• scripts/retrieve_ibm_job.py — no longer prints the first 50
  characters of the IBM Cloud CRN read from the vault. Resolves
  CodeQL alert #79 (py/clear-text-logging-sensitive-data).

Added

• analysis/koopman.py input validation — build_koopman_generator
  and koopman_analysis reject malformed input (non-square K,
  length-mismatched omega/theta_ref, NaN/Inf entries) and cap
  n_oscillators at MAX_OSCILLATORS_DEFAULT = 32 to prevent an
  unbounded n²×n² allocation followed by a multi-minute eigvals
  call. 13 new tests cover every guard branch.
• docs/pipeline_performance.md §21 publishes measured
  Python↔Rust speedups (4.7× – 19.5× across five paired benchmarks)
  and an explicit decision rule for when a new acceleration backend
  enters the build matrix.

Changed

• CI dev-tool matrix synced to current upstreams (PRs #36–#42):
  pytest 9.0.3, mypy 1.20.1, ruff 0.15.10, hypothesis 6.151.13,
  build 1.4.3, actions/upload-artifact 7.0.1,
  pypa/gh-action-pypi-publish 1.14.0.
• Public-facing docs scrubbed of self-applied quality labels (elite,
  STRONG tests, SUPERIOR documentation) in CHANGELOG.md,
  docs/changelog.md, docs/test_infrastructure.md,
  docs/symmetry_decay_guess.md, docs/dynq_qubit_mapping.md and 27
  test docstrings. Domain-technical uses (STRONG correlation
  verdict in stats tables, STRONG coupling in biochemical
  notebooks) are kept — they are field terminology.
• Stale counts refreshed across README.md, docs/architecture.md,
  docs/index.md, docs/pipeline_performance.md and
  docs/test_infrastructure.md: subpackages 19 → 20 (with the
  April-2026 psi_field/ and fep/ rows added), test suite 4 771 /
  4 828 → 4 841, pipeline-wiring 113 → 155, Rust path 51 → 68 tests
  over 37 functions, __all__ 77 → 104 symbols, three duplicate
  phantom rows removed from the docs/index.md package map.

Repository hygiene

• .coordination/sessions/ and .coordination/handovers/ are now
  local-only — 16 historical files untracked via git rm --cached.
• New .gitignore patterns for paper-extraction working files,
  .agent_metadata.json, and root-level misplaced handover_*.md.

Notes

• v0.9.4 and v0.9.5 were tagged but never released as GitHub
  releases. v0.9.6 captures all post-v0.9.3 work and is the first
  GitHub release since v0.9.3.
• See CHANGELOG.md for the full entry, including the v0.9.5 body of
  work (MS-QEC, FEP, Ψ-field, Phase 1 IBM Heron r2 hardware campaign,
  GUESS, DynQ, ICI / hypergeometric pulse shaping).

🤖 Generated with Claude Code