v2.6.0 — Stealth & MCP Hardening

Stealth & MCP hardening release. Reliability + security focus.

Added

• Stealth patch isolation — each fingerprint patch is now try/catch-isolated; one API mismatch degrades only that signal instead of aborting every later patch.
• attach_mode for attach_over_cdp — skips navigator.platform / WebGL vendor-renderer / screen-DPR overrides when attaching to a real browser, so the injected fingerprint no longer contradicts the real OS/GPU/display.
• MCP policy + approval gates — PolicyEngine (step-type/domain allow-lists) and ApprovalGate wired into the tools/call dispatch path and workflow replay. Fail-open by default (no policy files = allow all); operators opt into enforcement via STEALTH_MCP_POLICY or an approval callback.
• AdapterToolError — MCP tool results with isError: true are now surfaced instead of silently treated as success.

Fixed

• WebRTC ICE leak — per-instance onicecandidate rebind (no prototype-global leak) and addEventListener('icecandidate') is now filtered too; createDataChannel restored to real passthrough.
• playwright-mcp adapter — pinned @playwright/mcp@0.0.78 with corrected browser_navigate/browser_click/browser_type schema (element/target/text); prior CSS-selector args were rejected by the real server.
• CDP bridge — launch(profile) accepts a raw ws/wss/http(s) endpoint or a profile name resolved via CDP_ENDPOINT_<PROFILE>/CDP_ENDPOINT, aligning it with the BackendAdapter protocol.
• Recovery — rotation failure now propagates (returns False for ROTATE_*) and records _update_recovery_history(success=False); unique per-attempt session/proxy names avoid collisions.

Changed

• Adapter status() gains a canonical connected field (running kept as back-compat alias).
• SessionEnforcer documented as defined-but-inert until a multi-client transport supplies per-context tokens.

Full detail in CHANGELOG.md. Tests: 976 passing on CI.