release: SkillSpector 2.9.6

[rng1995]

SkillSpector 2.9.6

Prepares the public SkillSpector 2.9.6 patch release from current main.

Included

• bump the package and lockfile version from 2.9.5 to 2.9.6
• add the 2.9.6 changelog entry
• add versioned public release notes for the PE3 OAuth accuracy fix from fix(pe3): distinguish OAuth token nouns from access actions #392
• document that ordinary OAuth terminology no longer produces HIGH-severity credential-access findings while actionable access remains detected

Why a patch release

Only one fix has merged since v2.9.5, so this is a patch release. The fix removes a broad class of real-world HIGH-severity false positives across OAuth glossaries, return-value descriptions, revocation behavior, storage guidance, and supported-token tables. It replaces the narrow lifecycle allowlist with bounded grammatical classification while retaining fail-closed handling for credential actions and sensitive sources.

Release artifacts

No built artifacts are committed or manually uploaded in this PR. The established release:publish workflow builds and validates the wheel and sdist after this labeled PR merges, creates tag v2.9.6, and attaches both artifacts to the GitHub Release.

Validation

• uv lock --check
• focused release-workflow and PE3 suite: 132 passed
• suite excluding the two network-bound DNS/SSRF files: 2,158 passed, 13 skipped, 38 deselected, 4 expected failures
• full suite: 2,203 passed, 13 skipped, 38 deselected, 4 expected failures; seven known environment-specific failures because public GitHub/GitLab hosts resolve to internal addresses on this network
• ruff check src/ tests/ scripts/
• ruff format --check src/ tests/ scripts/
• built skillspector-2.9.6-py3-none-any.whl and skillspector-2.9.6.tar.gz
• twine check passed for both distributions
• git diff --check