v0.6.2: supporter-loop contract v1.10 — §8.4 over-scope probe correction (#136, PR #137)
CONTRACT.md v1.10 (post-freeze correction after the first live run): §8.4 no longer requires GET /repos/{reward_repo} to hide permissions.push == true (that object reflects the token owner's role, not the fine-grained grant). The endpoint is a reachability probe; the loop token's Contents 403/404 probe is the push-impossibility proof. Pairs with caty-ai/.github v0.11.5. No permission boundary weakened.