v3.26.0

AST engine: inter-procedural and nested-relation ownership detection for VG950/VG951 (BOLA/IDOR). Catches authorization checks performed in a helper the function calls, and ownership fields nested inside relation filters — shapes the same-function analysis could not see. Only session-derived ownership values count; request-controlled values keep firing. 3 corpus false positives removed, zero true positives lost, zero drift. Deterministic (bundled TypeScript parser). 450 rules / 39 tools.