Taint-engine points-to precision, and two default-adjacent capabilities
rebuilt from broken to sound: cross-call-site parameter type inference
and factory-function return-type inference for CHA, a ground-up rebuild
of SMT/exploit-proof path feasibility (opt-in), and a rebuild of
cross-service schema-driven taint (default-on) from a complete no-op to
a working, honestly-scoped mechanism. See CHANGELOG.md for full detail.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FSESg485K55fz5e6NdmCNe