v2026.09.01.06 — 2026-09-01

• docs: add WAF to the pending What's New buffer
• feat(waf): deep-link from the site toggle into the WAF settings page
• fix(waf): load per-site exclusions before global CRS to fix Detection-Only