v0.2.6

Security

• Bumped cryptography 49.0.0 → 50.0.0 in uv.lock
  (GHSA advisory, high severity): PKCS#7
  EnvelopedData decryption exposed a Bleichenbacher oracle through
  distinguishable errors and timing. The package is a transitive dependency
  (via authlib / joserfc / pyjwt in the FastMCP auth stack) and this
  server does not use PKCS#7 EnvelopedData, so exposure was minimal — but the
  image installs uv sync --frozen, so the fix only reaches users in a
  published release.

Changed

• Dependabot auto-merge now matches the uv package ecosystem. The
  condition tested package-ecosystem == 'pip' — the name declared in
  dependabot.yml — but the metadata action reports Dependabot's internal
  identifier, which is uv for a project resolved through uv.lock. The
  Python branch therefore never matched and no Python bump could auto-merge.
  It went unnoticed because the only Python PR so far was a major, which is
  excluded by design anyway.
• make release now creates the matching GitHub Release automatically
  (gh release create) after pushing the tag, using that version's
  CHANGELOG.md section as the release notes (extracted with awk).
  Previously the target only pushed the tag, so the Releases page drifted
  behind the tags and published images.
• make release now verifies that CHANGELOG.md has a ## [X.Y.Z] section for
  the version being released before it bumps, tags, or pushes anything. The
  target version is computed with uv version --dry-run (no mutation), and the
  release aborts early with a helpful message if the entry is missing — so a
  release can no longer be cut with empty auto-generated GitHub Release notes.