release: SkillSpector 2.10.0

[rng1995]

SkillSpector 2.10.0

Prepares the public SkillSpector 2.10.0 minor release from current main.

Included

• bump the package and lockfile version from 2.9.6 to 2.10.0
• promote the post-v2.9.6 changelog and add versioned public release notes covering 29 merged commits
• highlight bounded nested-artifact inspection, opt-in transitive scanning, structured skill summaries, EA5 external-model detection, localized LLM finding text, dynamic analyzer discovery, and additive report metadata
• document fail-closed completeness and reporting fixes, analyzer accuracy improvements, provider updates, and the LangGraph development extra
• preserve the original exported custom CLI-provider call contract for ordinary scans while retaining explicit deadlines for new bounded scan paths
• include the latest PE3 credential-store false-positive correction merged from fix(pe3): require a credential-store access shape, not a bare noun #424

Why a minor release

This release adds multiple backward-compatible user-facing capabilities and report fields, so a patch release would understate the scope. It does not remove an existing CLI command, option, or report field.

The post-v2.9.6 timeout work had also changed the documented AgentCLICapable.complete() protocol in a way that could break an existing injected CLI provider. This release restores that original protocol and omits the optional timeout keyword for ordinary scans; providers only need to accept it when participating in a new deadline-bounded path. With that compatibility guard, 2.10.0 is the appropriate SemVer update instead of 3.0.0.

Release artifacts

No built artifacts are committed or manually uploaded in this PR. The established release:publish workflow builds and validates the wheel and sdist after this labeled PR merges, creates tag v2.10.0, and attaches both artifacts to the GitHub Release.

Validation

• uv lock --check
• focused provider-compatibility, release-workflow, and wheel-content suite: 54 passed
• non-integration/provider suite with coverage: 2,937 passed, 13 skipped, 38 deselected, 4 expected failures
• ruff check src/ tests/ scripts/
• ruff format --check src/ tests/ scripts/ — 196 files already formatted
• built skillspector-2.10.0-py3-none-any.whl and skillspector-2.10.0.tar.gz
• twine check passed for both distributions
• skillspector --version reported SkillSpector v2.10.0
• the GitHub release helper dry run resolved tag v2.10.0 and the matching versioned release notes
• git diff --check