v5.3.1

Patch release: LOCO Python API/CLI fixes plus CI and test hardening. No changes to numerical results, CLI flags, or output formats.

Fixed

• LOCO Python eigen-cache API: `gwas(loco=True, write_eigen=True)` no longer raises "write_eigen=True requires eigen_dir to be set" — `PipelineConfig` now defaults `eigen_dir` to `output_dir` like the CLI (#37).
• LOCO `--legacy-text`: `--loco --legacy-text` now writes GEMMA-compatible `.txt` artifacts instead of silently emitting binary `.npy`; resolves GEMMA_DIVERGENCES §13 (#37).
• LOCO multi-pass eigendecomp reserve sizing: workspace reserve sized by valid-sample count, not the unfiltered count (#34).
• Link check: exclude canonical `gnu.org` license URLs that time out for CI bots (#35).

Added

• CodeQL SAST: weekly static analysis over the C extensions and Python sources (#38).

Changed

• Internal refactors across the LMM runners and pipeline (no behavior change): shared helper extraction and god-method decomposition (#26–#33).
• Test/CI hygiene: post-refactor docstring/typing/coverage follow-ups; batch/streaming FP-parity tests widen tolerance only under ASAN/UBSAN builds (#39).
• Dependency bumps: build-system numpy 2.4.4 → 2.4.5 (#24); prek-action and osv-scanner-action (#22, #23).

Full changelog: see CHANGELOG.md.