release: CodeInspectus v2.6.0 guided engine setup

[Synvoya]

Summary

• add consent-driven guided engine setup for interactive terminal users and MCP clients
• disclose every engine's purpose, license, exact platform download size, and installed/current state before approval
• bootstrap and verify managed engine downloads with immutable pins and Cosign while retaining fail-closed integrity checks
• preserve non-interactive MCP stdio startup and existing advanced repair-engines workflows
• add explicit platform compatibility guards and managed Opengrep runtime paths
• fix direct-file Supabase Edge Function analysis and update v2.6 provenance/version contracts
• document the Apache-2.0 package boundary and separate third-party engine licenses

Public projection verification

• fail-closed public allow-list applied from the merged private staging tree
• internal decision logs, seed tooling, and corpus contracts excluded
• projected tree matched this public commit byte-for-byte
• Node 22 build passed
• public test suite: 129 files, 1,419 tests passed
• eval suite: 55/55 passed, 0 failed, 0 skipped
• stdio smoke passed with 7 tools and pure JSON-RPC output
• packed SDK consumer E2E passed with package, CLI, and SDK at 2.6.0
• isolated macOS first-install and Alpine compatibility tests passed during staging

Release boundary

This PR updates the public GitHub source for v2.6.0. It does not create the signed tag or GitHub Release, publish npm or the MCP Registry, or deploy the website.