HEAD had advanced past the v0.2.6 tag (CONFIG.MD commit) without a
release; bump patch to publish, and fix stapel-core pin to match the
published 0.10.0 (old >=0.8,<0.9 no longer resolves against PyPI).

Co-Authored-By: Claude Sonnet <noreply@anthropic.com>