v2.6.8 – v2.6.13 — 2026-07-22

• feat(cra): evidence snapshots — audit trail of CRA readiness over time
• fix(cra): golangci-lint on CVE feed (errcheck + US spelling)
• feat(cra): live CVE feed — SBOM components matched against OSV.dev
• docs(plan): CRA cockpit stages 1-4 complete (SBOM, security.txt, incidents, snapshots)
• fix(cra): CVE feed — readable severity + per-component grouping
• feat(agent): pin package families to vendor current-stable repos (rspamd pilot)
• feat(agent): add PowerDNS, MariaDB, Dovecot to vendor upstream repos
• fix(agent): correct PowerDNS repo key + self-heal changed vendor keys