auvik-v0.2.0

Security

• Go toolchain bumped to go1.26.6, which fixes GO-2026-6218 (quadratic
  complexity in net/url, reachable from cliutil.ProbeReachable). The
  previously released binary was built with go1.26.5 and carried the advisory.
  CI could not catch this: the workflows request go-version: "1.26", which
  resolves to the latest patched Go, so the security gate scanned a patched
  toolchain while the build honoured the pinned one. See issue #210.

Fixed

• MCP tools are no longer default-denied. Every tool that is not a Cobra
  mirror - search, sql, context, and the auvik_search / auvik_get /
  auvik_execute code-orchestration trio - returned
  MCP tenant gate is not configured instead of running. The generated tenant
  gate treated "no platform source registered" as a failure rather than as
  "nothing to gate", and no connector registers one. The previously released
  binary had 6 dead tools. See issue #249.

• Windows binaries now exist. internal/cli/auvik_snapshot_lock.go called
  syscall.Flock, which does not exist on Windows, with no build tag - so the
  Windows targets had never compiled and were silently absent from the release
  assets, even though manifest.json declared win32 support. Split on
  //go:build, with LockFileEx on Windows.