v2.6.6 – v2.6.7 — 2026-07-21

• fix(deps): bump golang.org/x/text to v0.39.0 (GO-2026-5970)
• feat(cra): security.txt generator (RFC 9116) for coordinated disclosure
• fix(release): stable promotion advances sequentially, not to testing tip
• feat(cra): incident register (Art. 14 reporting evidence)