v1.6.0

## What's Changed
* Fix LiteLLM cost model resolution by @bearsyankees in https://github.com/usestrix/strix/pull/1069
* feat: place caller-provided files into the sandbox workspace (`extra_files`, `--workspace-file`) by @yoni-at-strix in https://github.com/usestrix/strix/pull/1085
* feat(reporting): contextual CVSS breakdown on dependency reports by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1091
* feat(reporting): require contextual CVSS and usage evidence on dependency reports by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1092
* handle resume tokens gracefully by @bearsyankees in https://github.com/usestrix/strix/pull/1097
* Add OWASP LLM Top 10 2026 skill coverage by @bearsyankees in https://github.com/usestrix/strix/pull/1115
* Add Azure and Entra security skill by @bearsyankees in https://github.com/usestrix/strix/pull/1119
* Add argument injection security skill by @bearsyankees in https://github.com/usestrix/strix/pull/1120
* Add ecosystem supply-chain security skills by @bearsyankees in https://github.com/usestrix/strix/pull/1121
* Add Hurl and Hypothesis security playbooks by @bearsyankees in https://github.com/usestrix/strix/pull/1122
* Add semantic browser and Electron security skills by @bearsyankees in https://github.com/usestrix/strix/pull/1123
* Expose viewer host option by @kusonooyasumi in https://github.com/usestrix/strix/pull/1127
* Drop strict tool schemas on Claude routes by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1136
* fix(tui): preserve cost when state is truncated by @kusonooyasumi in https://github.com/usestrix/strix/pull/1086
* fix(tui): use single space after ordered-list marker by @OpenPay-App in https://github.com/usestrix/strix/pull/1043
* fix(report): raise RuntimeError on non-object run.json (fixes #1109) by @vardhans07 in https://github.com/usestrix/strix/pull/1116
* better skills by @bearsyankees in https://github.com/usestrix/strix/pull/1139
* perf: take heavy imports off the startup path and pre-warm them in the background by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1141
* perf: bootstrap Caido concurrently with the scan start by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1143
* feat(agents): evidence discipline, and coverage as a first-class artifact by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/961
* Add MCP server support by @yoni-at-strix in https://github.com/usestrix/strix/pull/1137
* Treat literal 'null'/'none' strings as absent for optional tool args by @bearsyankees in https://github.com/usestrix/strix/pull/1164
* fix(update): re-exec runs the new binary after self-update (endless update-prompt loop) by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1168
* fix(tui): restore base foreground after ANSI resets by @bearsyankees in https://github.com/usestrix/strix/pull/1169
* Scope threat models to the current run instead of caching them on disk by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1178
* Reach MCP tools on demand instead of registering every one by @yoni-at-strix in https://github.com/usestrix/strix/pull/1175
* Isolate MCP connections per task and surface connection status in the UIs by @yoni-at-strix in https://github.com/usestrix/strix/pull/1181
* fix(llm): only attach prompt-cache points on routes LiteLLM serves by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1186
* fix(llm): bind dedupe credentials to a provider; send reasoning=max via extra_body by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1187
* fix(report): keep strix.report import-light so it never races the warm-up thread into the agents SDK graph by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1188
* Fix user message retry lifecycle and TUI sync by @0xallam in https://github.com/usestrix/strix/pull/1193
* csv injection hardening by @bearsyankees in https://github.com/usestrix/strix/pull/1203
* fix(viewer): harden PDF report rendering by @kusonooyasumi in https://github.com/usestrix/strix/pull/1192
* fix(runtime): stage extra-file bind mounts where a remote docker daemon can see them by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1211
* Make MCP connections survive transient transport failures by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1184
* feat(cli): strix cloud — managed platform CLI (login, scans, billing, and the rest of the API) by @bearsyankees in https://github.com/usestrix/strix/pull/1177
* pentest skill cloud cli by @bearsyankees in https://github.com/usestrix/strix/pull/1220
* Forward the workspace header through cli by @bearsyankees in https://github.com/usestrix/strix/pull/1221
* report: add update_vulnerability_report so an agent can revise a filed finding by @bearsyankees in https://github.com/usestrix/strix/pull/1210
* chore: release v1.6.0 by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1223

## New Contributors
* @OpenPay-App made their first contribution in https://github.com/usestrix/strix/pull/1043
* @vardhans07 made their first contribution in https://github.com/usestrix/strix/pull/1116

**Full Changelog**: https://github.com/usestrix/strix/compare/v1.5.3...v1.6.0