2.6.0

## What's Changed
* fix(web): reset pending OAuth slots during render, not in an effect by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2237
* fix: terminate the OAuth connection-details refresh promise chain by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2236
* fix: key the OAuth clear's active-session check on the storage key by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2238
* chore(deps): npm audit fix before release bump; monthly npm-outdated issue by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2232
* chore(deps): remove dependabot.yml, fold action bumps into the monthly sweep by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2239
* chore(deps): sweep Dependabot alerts into board-tracked issues by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2243
* test(auth): make the revocation fixture a real form-urldecoder by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2246
* chore(deps): refresh fast-uri, qs and browserslist to clear npm audit by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2249
* feat(skills): measure a skill reached from another skill by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2245
* fix(web): remove the wall-clock race in the import-JSON debounce guard test by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2255
* fix(auth): floor the shared revocation budget instead of racing zero by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2256
* feat: support the Skills extension (SEP-2640) with digest verification by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2251
* chore: grant artifact-metadata:write to the GHCR publish job by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2258
* fix: type-discriminate progress toast ids, and a CSPRNG fallback for newAttemptId by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2259
* chore: widen verify:dep-lockstep to declared cross-install copies by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2260
* Reshape the testing → test-servers pointer into an imperative step by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2261
* fix: cap the re-auth banner width and move its flat CSS into the Paper theme by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2266
* feat: refactor the Skills detail pane into collapsible sections with an internally-scrolling file viewer by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2265
* feat: watch the MCP SDK nightly and file an upgrade issue by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2268
* fix: swap the toast ref Set on teardown instead of clearing it by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2267
* docs: specify screenshot capture width and Monitor sidebar width in /pr-flow by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2271
* docs: rule that a wait is a notification, never a tight poll loop by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2272
* docs: reply to each review comment in its own thread, not in a rollup comment by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2273
* docs: add a reusable CLI smoke-testing guide for v2 by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2275
* fix: send an empty-string pagination cursor verbatim on every list adapter by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2277
* fix: decline a union branch requiring a name it never declares by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2276
* fix: strip ANSI from TUI test frames so FORCE_COLOR cannot break assertions by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2279
* fix: key resource list rows by position so duplicate URIs cannot collide by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2281
* feat: seed the MCP org example server as a remote first-run card by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2283
* feat(web): collapse the schema-portability section by default by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2285
* fix: preserve CIMD registration provenance across SDK issuer binding by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2287
* docs: ALLOWED_ORIGINS recipe for a `*.localhost` proxy by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2290
* fix: report a terminal OAuth token-endpoint refusal instead of a dead retry by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2288
* fix: two load-dependent Storybook flakes — SkillsScreen geometry and the Ace-worker wait by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2291
* feat: Skills extension phase 3 — CLI methods, TUI pane, resources/directory/read, and the frontmatter cross-check by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2293
* docs(release): make the two-PR flow, the production smoke, the ledger and the UI tag explicit by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2299
* chore(release): audit, hono advisory fix, and bump to 2.6.0 by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2302
* chore: merge v2/main for the v2.6.0 milestone release by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2304


**Full Changelog**: https://github.com/modelcontextprotocol/inspector/compare/2.5.0...2.6.0
Smoke test ledger for milestone branch: [v2/chore/milestone-merge-v2.6.0](https://claude.ai/code/artifact/e02d91dc-92d2-4fac-8418-17407a2d4c50) 
SEP-2640 support added: [Verifying Skills over MCP](https://claude.ai/code/artifact/82fc4f18-71b3-4e8f-8128-705e2f351f59)