v0.6.4

• chttp, mcp/registry (fix): a name with password, passphrase or secret anywhere in it is a credential's, where only a name ending in one was. passwordConfirmation was written to the write log in clear under an argument a server said was safe to show, and was shown in a trace; so was any name with something after the word. SecretName, RedactJSON, a trace and the line written for a write all go by the one rule. The price is a harmless name with the word in it, passwordHint, hidden too. A token, a cookie or a key is still known only by how its name ends, so maxTokens is left alone
• chttp, cout, mcp/registry, test/replayproxy, test/services/sabnzbd: tidied for three rules a newer lint asks for, with no change in what any of them does: a pointer is checked before it is followed, a field set to its empty value is left out, and an import lost a second name it did not need. Nine Go files changed for this alone
• every package: built, linted and tested with Go 1.27.2, where it was 1.26.6. go.mod still asks for Go 1.26 and the tests still run on 1.26.0, so nothing changes for a project that uses the library