release: v2026.6.0 — code-review hardening + paid-code strip - #13

_scan_git_repo was missing the parameter in both its signature and the
call site, causing NameError: name 'include_user_mcp_configs' is not
defined on every medusa scan --git invocation in v2026.5.10.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Adds test_ship_gate.py covering every major user-facing feature: --fail-on,
--exclude, --workers, --no-report, --no-cache, --quick, --force,
--include-user-mcp-configs, all output formats, HMAC tamper/full_hash/
rule-fingerprint cache internals, secrets command safety gates, and
MedusaParallelScanner direct params.

Also adds TestScanGitRepoRegression to test_git_scan.py to lock in the
--git NameError fix and prevent parameter-forwarding regressions.

Gitignores working-notes scratch files (issue.md, graphify-out/, etc).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…integrity rewrite

Biggest rule release in MEDUSA's history: 9,600 -> 40,000+ detection patterns
harvested from 8,466 AI-security research papers across 41 attack categories,
false-positive-hardened against real-world reference libraries (zero harvest-rule
FPs on clean code), with 121 genuine detectors recovered via context guards.

Security/quality:
- rule_integrity: structural field-aware YAML scanner (closes indentation
  prompt-in-a-prompt bypass; removes brittle line-prefix allowlist)
- report-path neutralize_injection() defence-in-depth (+5 tests); ReDoS fixed
- tightened test thresholds (dup-IDs 600->60, compile <=10->0; no vacuous skips)
- .medusa.yml: stop excluding ML/pickle/model formats (core scanning capability)
- analyzer count corrected to 79; docs/README/CHANGELOG/CLAUDE.md refreshed
- benchmark regression re-baselined (internally consistent)

Known (pre-existing, next release): report-path injection via rule message/name
reaching LLM-consumed reports needs full output-delimiting architecture.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Resolves 20 findings from a full /code-review (security, reliability,
correctness) and removes paid-tier code from the free package. Combines with
the v2026.5.12 content (40k rules + FP-hardening + integrity rewrite).

Reliability / correctness:
- CR-001: --fail-on now actually fails (was a string-vs-enum compare → no-op gate)
- CR-002: `medusa scan --git` no longer crashes (NameError: no_ai_safe + missing `import os`)
- CR-008: file cache persists from the parent process (--quick was a silent full scan)
- CR-009: skip FIFOs/sockets/devices (a special file in the tree hung the whole scan)
- CR-010: per-scanner timeout uses BaseException (scanners' `except Exception` no longer swallows it)
- CR-011: scanner crashes/timeouts recorded + summarised (no more silent finding suppression)
- CR-030: atomic cache write (tmp + os.replace)
- CR-032: os.walk onerror — warn on unreadable subtrees instead of silent coverage loss
- CR-034 / CR-051: hardened rule-load + config null guards; venv-detect catches OSError
- CR-036: internal errors exit 3 (distinct from 1=findings, 2=usage)

Security:
- CR-012: git clone hardened env (no credential prompt) + scrubbed timeout handler (no token leak)
- CR-027: reject cleartext http:// clones
- CR-028: report dir 0o700 (reports embed detected secrets)
- CR-031: --filter=blob:limit=5m clone size bound
- CR-049: defense-in-depth HTML / Markdown escaping

Readability / output:
- CR-019 / CR-020: analyzer + rule counts corrected to 79 / 40,000+
- CR-037: tightened tautological --fail-on ship-gate tests
- CR-048: removed stale version string in `install` docstring
- Suppress the nested-set FutureWarning that flooded scan output — severe on
  Windows where spawn-mode workers re-emit it per worker. Underlying pattern
  audit tracked for 2026.6.1 (CR-050).

Paid-code strip: removed licensing.py, api/, and runtime rules from the free
package (the paid tier is a separate hosted service, not shipped code) and
cleaned all references. The free product is fully standalone.

Build: scripts/build-wheel.sh produces a leak-gated wheel.

Deferred to 2026.6.1: scan-perf engine redesign (CR-005/006) + perf micro-opts
+ architecture refactors (CR-007/021-025/045) + CR-050 nested-set pattern audit.

Regression: 441 passed, 0 failures. Wheel smoke-tested 7/7 in a clean Linux
venv; Windows scan verified working (warning-spam fix applied; re-test pending).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>