21.7.11

What's Changed

• Add OpenSSF Scorecard workflow by @gaborbernat in #3238
• Document AI-assisted contributions and licensing policy by @gaborbernat in #3239
• 👷 ci(release): attest and sign release provenance by @gaborbernat in #3242
• 👷 ci: harden Scorecard-scored checks in CI by @gaborbernat in #3241
• 🐛 fix(ci): parallelize graalpy tests, recover crashed workers by @gaborbernat in #3240
• 🐛 fix(ci): mark real-shell activation tests as slow by @gaborbernat in #3243
• 👷 ci: run macOS jobs on macos-26 by @gaborbernat in #3244
• 🐛 fix(activation): undo a live activation before activate.bat saves values by @darrenhuai in #3245
• 🐛 fix(create): keep pyvenv.cfg values on a single line by @gaborbernat in #3247
• 🔧 chore(test): add opt-in Atheris fuzz harness by @gaborbernat in #3246
• 📝 docs(readme): add OpenSSF Best Practices badge by @gaborbernat in #3248

Full Changelog: 21.7.10...21.7.11