threatlocker-v0.3.1

Security

• Go toolchain bumped to go1.26.6, which fixes GO-2026-6218 (quadratic
  complexity in net/url, reachable from cliutil.ProbeReachable). The
  previously released binary was built with go1.26.5 and carried the advisory.
  CI could not catch this: the workflows request go-version: "1.26", which
  resolves to the latest patched Go, so the security gate scanned a patched
  toolchain while the build honoured the pinned one. See issue #210.

Fixed

• MCP tools are no longer default-denied. Every tool that is not a Cobra
  mirror - search, sql, context, and the threatlocker_search / threatlocker_get /
  threatlocker_execute code-orchestration trio - returned
  MCP tenant gate is not configured instead of running. The generated tenant
  gate treated "no platform source registered" as a failure rather than as
  "nothing to gate", and no connector registers one. The previously released
  binary had 6 dead tools. See issue #249.