chore: release v0.5.76 — ship pipeline auto-commit

[githubrobbi]

Summary

just ship Phase 2 auto-commit for v0.5.76. This PR routes the version-bump commit through branch-protection rules (auto-merge squash).

Folded into the auto-commit: supply-chain/config.toml exemption bump for libc 0.2.185 → 0.2.186 (crates.io patch update). cargo vet would otherwise have blocked the pre-push hook on libc:0.2.186 missing ["safe-to-deploy"]. Same criteria preserved.

Auto-merge

--auto --squash is queued — GitHub will merge as soon as the required status checks pass. Squash is required because main-protection mandates signed commits, and GitHub's rebase-auto-merge cannot sign the rebased commit; the squash-merge commit is signed by GitHub's own key, which satisfies required_signatures: true. The original author's signed commit remains verifiable in the PR branch history.

After merge

Local main had this commit with a different SHA before squash rewrote it onto main; recover with git fetch origin && git reset --hard origin/main (or just sync, available since v0.5.75).

auto-tag-release.yml will tag v0.5.76 on push-to-main; release.yml then builds and publishes the cross-platform binaries.

Release contents

• fix(api-validation): dot-gated extension extraction so .bash_history sorts as empty (scripts/windows/api-validation.rs). Closes the third copy of the bug — CLI / MCP / API lanes now share semantics. (fix(api-validation): dot-gated extension extraction so .bash_history sorts as empty #73)
• chore(supply-chain): bump libc exemption to 0.2.186.