2.6.0

What's Changed

• fix(web): reset pending OAuth slots during render, not in an effect by @cliffhall in #2237
• fix: terminate the OAuth connection-details refresh promise chain by @cliffhall in #2236
• fix: key the OAuth clear's active-session check on the storage key by @cliffhall in #2238
• chore(deps): npm audit fix before release bump; monthly npm-outdated issue by @cliffhall in #2232
• chore(deps): remove dependabot.yml, fold action bumps into the monthly sweep by @cliffhall in #2239
• chore(deps): sweep Dependabot alerts into board-tracked issues by @cliffhall in #2243
• test(auth): make the revocation fixture a real form-urldecoder by @cliffhall in #2246
• chore(deps): refresh fast-uri, qs and browserslist to clear npm audit by @cliffhall in #2249
• feat(skills): measure a skill reached from another skill by @cliffhall in #2245
• fix(web): remove the wall-clock race in the import-JSON debounce guard test by @cliffhall in #2255
• fix(auth): floor the shared revocation budget instead of racing zero by @cliffhall in #2256
• feat: support the Skills extension (SEP-2640) with digest verification by @cliffhall in #2251
• chore: grant artifact-metadata:write to the GHCR publish job by @cliffhall in #2258
• fix: type-discriminate progress toast ids, and a CSPRNG fallback for newAttemptId by @cliffhall in #2259
• chore: widen verify:dep-lockstep to declared cross-install copies by @cliffhall in #2260
• Reshape the testing → test-servers pointer into an imperative step by @cliffhall in #2261
• fix: cap the re-auth banner width and move its flat CSS into the Paper theme by @cliffhall in #2266
• feat: refactor the Skills detail pane into collapsible sections with an internally-scrolling file viewer by @cliffhall in #2265
• feat: watch the MCP SDK nightly and file an upgrade issue by @cliffhall in #2268
• fix: swap the toast ref Set on teardown instead of clearing it by @cliffhall in #2267
• docs: specify screenshot capture width and Monitor sidebar width in /pr-flow by @cliffhall in #2271
• docs: rule that a wait is a notification, never a tight poll loop by @cliffhall in #2272
• docs: reply to each review comment in its own thread, not in a rollup comment by @cliffhall in #2273
• docs: add a reusable CLI smoke-testing guide for v2 by @cliffhall in #2275
• fix: send an empty-string pagination cursor verbatim on every list adapter by @cliffhall in #2277
• fix: decline a union branch requiring a name it never declares by @cliffhall in #2276
• fix: strip ANSI from TUI test frames so FORCE_COLOR cannot break assertions by @cliffhall in #2279
• fix: key resource list rows by position so duplicate URIs cannot collide by @cliffhall in #2281
• feat: seed the MCP org example server as a remote first-run card by @cliffhall in #2283
• feat(web): collapse the schema-portability section by default by @cliffhall in #2285
• fix: preserve CIMD registration provenance across SDK issuer binding by @cliffhall in #2287
• docs: ALLOWED_ORIGINS recipe for a *.localhost proxy by @cliffhall in #2290
• fix: report a terminal OAuth token-endpoint refusal instead of a dead retry by @cliffhall in #2288
• fix: two load-dependent Storybook flakes — SkillsScreen geometry and the Ace-worker wait by @cliffhall in #2291
• feat: Skills extension phase 3 — CLI methods, TUI pane, resources/directory/read, and the frontmatter cross-check by @cliffhall in #2293
• docs(release): make the two-PR flow, the production smoke, the ledger and the UI tag explicit by @cliffhall in #2299
• chore(release): audit, hono advisory fix, and bump to 2.6.0 by @cliffhall in #2302
• chore: merge v2/main for the v2.6.0 milestone release by @cliffhall in #2304

Full Changelog: 2.5.0...2.6.0
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.6.0
SEP-2640 support added: Verifying Skills over MCP