v2.19.9

Tighten DKIM TXT observations without expanding collection or changing the
compact output contract.

Fixed

• Google and generic DKIM selectors use one bounded tag-list parser. Version
  lookalikes, misplaced version tags, duplicate tags, malformed key material,
  and missing or revoked p= values no longer create DKIM control claims.
• Recognize the specified omitted-version default and permitted whitespace.
  Preserve raw positive evidence, later valid selectors and existing CNAME
  delegation observations. This is record-shape admission, not cryptographic
  validation, message verification, or proof of active signing.

Security

• Raise the development-only virtualenv floor to 21.14.1 and refresh its
  interpreter-discovery dependency. This removes PYSEC-2026-4011 through 4014
  from the locked pre-commit toolchain, including activation, configuration
  injection and downloaded seed-wheel verification fixes. Neither package is
  added to recon's runtime dependencies.

Tool Surface Changes

Tool surface changes: no CLI command, flag or JSON schema changes.