parsemail v2.6.0 * Devtools update pin (729f21b) * Grade the egress probe against a control on the egress network, since Docker drops where podman has no route (034a4b9) * Merge the devtools includes into one entry with one ref, and add make devtools-update (8fb5f80) * Update devtools (8d31261) * Fuzz the upload path nightly against stated properties, and fix the two charset crashes it led to (ebbaad4) * Build a dry-run image on every branch push, with a manual smoke test, and use devtools' .dind template (8df2b0d) * Add a schedule-only heartbeat to the nightly, and model scheduled pipelines as branch pipelines in ci_lint (9a13257) * Use devtools' VEX scripts, keep the tooling venv installable on any Python, and move devtools to 30507dd (3bb69ee) * Use devtools' shared .sigstore template instead of a local copy (6c8534f) * Set timeouts on the four slow CI jobs, allow urllib3 in ci_lint, and run devtools' ci-lint too (800cbc7) * Cache only successful responses, so a 404 never gets a path's cache tier (058964b) * Escape the text split off before linked domains, and treat DKIM's i= as a tag on the page and in extraction (7acd9f8) * Close the leaked wake socket and HTTPError responses, and stop doubling the full stop on upload errors (9b7716d) * Keep extra= fields from overwriting the JSON log's own time, level, logger, pid, exception and stack (090994a) * Decode 8-bit attachment filenames from the raw headers instead of get_filename's replacement characters (6757100) * Match domains case-insensitively so upper-case TLDs are extracted and linked (3128d84) * Parse uploads with BytesFeedParser so binary attachments keep their CR bytes (b57f0eb) * Keep a failing renderer from failing the upload, and list parts after an empty one (117fb95) * Add a unit test suite gated at exactly 100% line and branch coverage, with strict xfails for 16 bugs it found (da1c5f9) * Confine every parsemail process with a seccomp denylist, self-tested at build (cd7530e) * Set no DNS search list for parsemail, closing CVE-2026-8674's DHCP/VPN path in the shipped stack (c673e0d) * Assess CVE-2026-8674 (glibc resolver abort) as affected, via host DNS config only (c7fca11) * Run make inside the CI image via devtools' container.mk, keeping only image, stack and release targets on the host (69c0abc) * Add RELEASING.md and CONTRIBUTING.md, moving the maintainer and contributor material out of the README (5e87056) * Use the Makefile's RUNTIME in release.sh instead of hard-coded docker (a51effc) * Correct stale statements in CLAUDE.md and the README about setup, reproducibility, release_image and tooling (9b6ee2e) * Verify the Makefile's syft, grype and pip downloads by SHA256, and pin the lint job's PyYAML (2b93d39) * Start every guarded CI block with set -e, and lint for it (739713b) * Make release.sh fetch, refuse a stale branch or unpinned key up front, and require a release-key signature (68a76cd) * Keep THIRD-PARTY-NOTICES.md versions in step with the lock and the image (3676158) * Measure the egress check from parsemail's own namespace and require ENETUNREACH (dd4ff4b) * Keep CI tokens out of argv and .git/config: credential helper for push, header file for curl (5773ed6) * Stop the daily job when the published image cannot be compared, instead of releasing (5705e14) * Count a tag signature only when GOODSIG and VALIDSIG are in the same gpg record (39e365e) * Apply a 7-day release cooldown to version checks, bumps and lockfiles via devtools (a4f8918) * Commit message: Attest the merged SBOM: derive the SPDX from the CycloneDX instead of a second syft run (89bae99) * Install devtools (83258e8)