v0.8.26 — Balance-aware codegen break-out + public guard benchmark

Fixed

• Balance-aware codegen break-out detection. CodegenDelimiterInjectionGuard no longer over-blocks benign code-like arguments (dict access data['key'], embedded JSON, lists). A break-out token inside an open ( [ { region (a complete structured literal) is treated as benign data; a top-level break-out fragment — the real CVE-2026-11393 shape — still denies. Defense-in-depth preserved: actual code sinks (eval/exec/__import__) remain caught by the eval-RCE guards. False-positive rate on code-like inputs dropped 13.3% → 0%.

Added

• Reproducible guard-suite benchmark — make benchmark → BENCHMARK.md: 100% detection (21/21), 0% false-positives (0/17) on a deterministic, OWASP-tagged self-corpus, with a CI drift gate (--check). It is a coverage/regression baseline, not an adaptive-attacker (ASR) result.

Changed

• README hero + package description repositioned around the differentiated wedge: in-process, per-argument tool-call validation (ghost-argument stripping, strict Pydantic, self-healing retries).

Full notes in CHANGELOG.md.