v0.1.0-lab.9

• build(deps): take h2 0.4.17 for RUSTSEC-2026-0258
• fix(server): carry the cache descriptor on tools/list
• docs: document audit forwarding and where the trail goes
• chore: re-pin the SBOM guard to 0.11.0 as well
• chore: re-pin mecmcp to v0.11.0
• fix: wire --allow-insecure-bind into the transport config
• chore(packaging): move the pinned mecmcp component versions to 0.10.0
• chore(packaging): move the pinned mecmcp ref to v0.10.0
• chore(deps): mecmcp v0.10.0

Changes since v0.1.0-lab.8: 13 files changed, 361 insertions(+), 90 deletions(-)

---

Published retroactively; summarised from the commit range, as this repository keeps no CHANGELOG. Tagged 2026-08-19.