0.2.6

chore(deps): 0.2.6 — bump cisco-ai-skill-scanner 2.0.9 → 2.0.11 (#17)

* chore(deps): 0.2.6 — bump cisco-ai-skill-scanner 2.0.9 → 2.0.11

Replaces Dependabot PR #10 with the full `wrapper/CISCO_PIN.md` bump
procedure. The bump folds in 2.0.10's rule-pack expansion (34 → 314
signatures, restructured by category) and 2.0.11's internal release-
pipeline fix. 2.0.10's opt-in surface (OpenAI-compatible LLM endpoints,
LiteLLM Gemini fallback, `--render-markdown`) does not affect Pruner;
the wrapper stays deterministic at v0.x.

Touched five surfaces for version consistency:

- `wrapper/pyproject.toml` — pin
- `wrapper/src/pruner_wrapper/cisco_runner.py` — `PINNED_VERSION`
- `scripts/setup-cisco.sh` — default
- `wrapper/CISCO_PIN.md` — version, release date, upstream main HEAD
  `ff708ea00fd401640112c138711c5c36ff4992a0` (2026-04-30), license
  re-verified 2026-05-11
- `wrapper/README.md` — pin reference
- five wrapper test fixtures (`test_cisco_runner.py` asserts the
  constant; the other four use the version as fixture data)

`docs/fp-audit.md` gets a 0.2.6 audit section with full reproduction
against the canonical corpus (`coroboros/agent-skills`,
`anthropics/skills`, `vercel-labs/agent-skills`):

- Coroboros pack (`--without-cisco`) deltas vs 0.1.0: +1 FC003 (corpus
  added one new skill matching the existing non-canonical-frontmatter
  pattern) and +1 PI-PERM-001 on `skills/design-system/SKILL.md` (rule
  added in 0.2.0, true positive). Three 0.1.0 tracking notes still
  apply unchanged.
- Cisco dual-version parity check (`--with-cisco` with 2.0.9 then 2.0.11
  on the same corpora): **identical rule-id distribution and counts**
  on both `coroboros/agent-skills` (22 findings, 6 rule IDs) and
  `vercel-labs/agent-skills` (20 findings, 8 rule IDs). The 280 newly
  added Cisco signatures fire on neither — likely target patterns not
  present in well-formed skill repositories.

License-drift guard re-validated: 2.0.11 ships Apache-2.0 intact at
`<venv>/lib/python*/site-packages/cisco_ai_skill_scanner-2.0.11.dist-info/licenses/LICENSE`.

Tests: 263 passed, coverage 90.83 percent.

* docs: humanize CHANGELOG and fp-audit entries against Coroboros voice

Three first-person plural instances ("our SARIF-upload-only use case",
"our dogfood targets", "our corpora") removed per the BRAND-VOICE.md
pronoun rule (third-person institutional, no first-person plural in
corporate communications).

One em-dash density hit on the fp-audit Per-repo bullet for
coroboros/agent-skills reduced from three em-dashes per line to one;
brand voice allows em-dashes, but three on a single line is busy. The
header em-dash separator stays, the inline clauses move to commas and
a colon.