release: prepare ZUPT 5.2.6 native gates

SECURITY.md

@@ -1,4 +1,4 @@
-# Security Policy — ZUPT 5.2.5
+# Security Policy — ZUPT 5.2.6
 
 ## Reporting vulnerabilities
 
@@ -66,7 +66,7 @@ partially accepted.
 
 ### Optional integrations
 
-The 5.2.5 default is `WITH_SDK=0 WITH_PQBOX=0`:
+The 5.2.6 default is `WITH_SDK=0 WITH_PQBOX=0`:
 
 - `WITH_SDK=1` enables libvuptsdk-backed features, including the SDK PQ mode
   and Argon2id support, using a separately installed system development package.
@@ -133,12 +133,19 @@ can compromise archives encrypted to it.
 
 ## Constant-time and side-channel scope
 
-Portable C is the 5.2.5 default. Sensitive comparisons and selections use
+Portable C is the 5.2.6 default. Sensitive comparisons and selections use
 branchless helpers, but generated machine-code behavior remains dependent on
 the compiler and platform. This is not a formal whole-program constant-time
 claim. The C AES implementation uses table lookups and is unsuitable for a
 claim of cache-timing resistance on hostile shared hardware.
 
+Sensitive VaptVupt working buffers are cleared through a compiler-resistant
+wipe helper. Platforms with a guaranteed libc `explicit_bzero` use it; macOS
+and NetBSD use the portable volatile-write fallback because the supported
+deployment targets do not guarantee that symbol. This source-level choice
+resists ordinary dead-store elimination but is not a formal claim about every
+compiler binary.
+
 Textual assembly under `jasmin/` can be enabled explicitly with
 `WITH_JASMIN=1` on a supported x86_64 compiler target. The directory contains
 Jasmin-generated output and separately identified hand-written assembly; all of
@@ -197,7 +204,7 @@ media before proceeding.
 
 The Windows handle-relative implementation is scoped to normal local Win32
 paths. Win32 extended-length and device-namespace paths, raw UNC output roots,
-and mapped/network-drive output are not supported in 5.2.5. Cross-build and
+and mapped/network-drive output are not supported in 5.2.6. Cross-build and
 Wine results are not native-Windows evidence; the `windows-latest` package gate
 must pass its Unicode round trip before Windows assets are published. Restore
 to a normal local directory first and move verified output to network storage
@@ -240,7 +247,7 @@ shared/static library, or distribution package. Audit them with:
 
 ```sh
 scripts/check-source-only.sh
-scripts/check-source-only.sh --archive /path/to/zupt-5.2.5.tar.gz
+scripts/check-source-only.sh --archive /path/to/zupt-5.2.6.tar.gz
 ```
 
 Nested archive inspection is required to enforce bounded recursion, member
@@ -250,13 +257,13 @@ limit violations. On commit `ff99770`, the source-only scanner suite passed
 
 DEB, binary RPM, SRPM, notice-bearing Linux tar.xz, source-only portable GUI
 ZIP, Windows ZIP, and macOS DMG release assets are separate outputs. An
-AppImage is not promoted for 5.2.5. A bare Linux or Windows executable is also
+AppImage is not promoted for 5.2.6. A bare Linux or Windows executable is also
 excluded; executables are distributed only inside their notice-bearing
 archives. Trust an artifact only when its exact format has a recorded build,
 content/metadata inspection, extracted or installed smoke test, and applicable
 archive round trip. Never treat an unexecuted platform as passing.
 
-The gated 5.2.5 set is the CLI package/archive set plus the exact GUI DEB,
+The gated 5.2.6 set is the CLI package/archive set plus the exact GUI DEB,
 noarch/source RPM, and source-only portable ZIP documented in the README. The
 portable GUI ZIP contains no compiled runtime and is scanned as source before
 and after extraction. Other GUI packages, AppImage, AppDir and Flatpak bundles,
@@ -296,7 +303,7 @@ result.
 
 Post-tag CI integration failures prevented 5.2.2 promotion. Those upstream
 self-audit results are not independent certification and do not transfer to
-5.2.5. The immutable 5.2.3 candidate was not promoted because its source-policy
+5.2.6. The immutable 5.2.3 candidate was not promoted because its source-policy
 test assumed LF for a Windows `.bat` file checked out as CRLF. The immutable
 v5.2.4 candidate was not promoted after exact-tag GitHub Actions run
 `33431386002`: 12 jobs succeeded, the sole openSUSE job failed in its
@@ -306,11 +313,18 @@ Tumbleweed reproduction confirmed that `refs/tags/v5.2.4` is valid and that
 `os.chdir(service_dir)` lets `obs_scm`, `tar`, and `recompress` complete with a
 source-scanned archive. This was a release/test integration defect, not a
 product, archive, cryptographic, codec, or SDK ABI change, and its evidence does
-not transfer automatically to 5.2.5. The exact 5.2.5 candidate must repeat the
-required suite. Native Windows and macOS, hosted GitHub CI/release promotion,
-authenticated OBS, and the openSUSE automatic `debugsource` rpmlint `no-binary`
-finding remain pending until recorded otherwise. An unavailable or unexecuted
-environment remains `SKIP`, never `PASS`.
+not transfer automatically to 5.2.6. The immutable v5.2.5 candidate was also
+not promoted: exact-tag GitHub Actions run `33434986357` recorded 13 successful
+jobs and failed native Windows/macOS jobs. Its Windows fixture-byte and macOS
+secure-wipe/Bash 3.2 defects are corrected for 5.2.6, but those changes have not
+yet passed exact-5.2.6 hosted or native gates. A targeted clean-clone run of the
+corrected scanner under genuine GNU Bash 3.2.57 passed repository, standalone
+tree, standalone archive, and root-plus-tag modes; that local compatibility
+result does not transfer to any other gate. The exact 5.2.6 candidate must
+repeat the required suite. Native Windows and macOS, hosted GitHub CI/release
+promotion, authenticated OBS, and the openSUSE automatic `debugsource` rpmlint
+`no-binary` finding remain pending until recorded otherwise. An unavailable or
+unexecuted environment remains `SKIP`, never `PASS`.
 
 Run target-native static analyzers and package checks as additional evidence.
 Do not infer x86_64, aarch64, ppc64le, s390x, riscv64, macOS, Windows, Leap, or