release(4.4.0): scan budget, Cookie pair scanning, dynamic rule overlay

[rennf93]

Delivers issue: #170

Closes #170

Description

Version bump to 4.4.0 via bump_version.py (pyproject.toml, .mike.yml, versions.json, SKILL.md, CHANGELOG, release notes) plus the v4.4.0 notes covering #162, #163, #165, #167, #169 and the repo chores (#158, #159, #160).

---

Motivation and Context

Python family release, engine first. Behavior to know is called out in the notes: dynamic rule versions no longer carry over the previous version's changes.

---

Type of change

• Documentation change

---

How Has This Been Tested?

Gate results are in a PR comment once run.

---

Checklist:

• My code follows the code style of this project
• I have updated the version number if necessary

[github-actions]

Detection gate report

All detection gate shards passed.

Shard arbiter-grammar

Gate green: no category regressed against its committed baseline and no benign string is newly flagged.

Total recall: n/a. Total false-positive rate: n/a.
Documented known gaps: 0. Documented known false positives: 0. Both stay in the denominators.

Full per-case output is in the job log.

Shard benchmarks-and-rest

Gate green: no category regressed against its committed baseline and no benign string is newly flagged.

Total recall: 378/386 (97.9%). Total false-positive rate: 23/370 (6.2%).
Documented known gaps: 8. Documented known false positives: 23. Both stay in the denominators.

Category	Recall	False positives
cmd_injection	38/46 (82.6%)	10/370 (2.7%)
cms_probing	36/36 (100.0%)	0/370 (0.0%)
code_injection	3/3 (100.0%)	0/370 (0.0%)
deserialization	18/18 (100.0%)	0/370 (0.0%)
dir_traversal	10/10 (100.0%)	0/370 (0.0%)
file_inclusion	16/16 (100.0%)	3/370 (0.8%)
file_upload	32/32 (100.0%)	0/370 (0.0%)
http_split	4/4 (100.0%)	0/370 (0.0%)
ldap	25/25 (100.0%)	0/370 (0.0%)
nosql	10/10 (100.0%)	0/370 (0.0%)
path_traversal	13/13 (100.0%)	0/370 (0.0%)
proto_pollution	8/8 (100.0%)	0/370 (0.0%)
recon	23/23 (100.0%)	0/370 (0.0%)
sensitive_file	16/16 (100.0%)	0/370 (0.0%)
sqli	38/38 (100.0%)	6/370 (1.6%)
ssrf	32/32 (100.0%)	4/370 (1.1%)
template	13/13 (100.0%)	1/370 (0.3%)
xml	4/4 (100.0%)	0/370 (0.0%)
xss	39/39 (100.0%)	0/370 (0.0%)

Full per-case output is in the job log.

Shard builtin-safety

Gate green: no category regressed against its committed baseline and no benign string is newly flagged.

Total recall: n/a. Total false-positive rate: n/a.
Documented known gaps: 0. Documented known false positives: 0. Both stay in the denominators.

Full per-case output is in the job log.

Shard cpu-load-arbiter-grammar

Gate green: no category regressed against its committed baseline and no benign string is newly flagged.

Total recall: n/a. Total false-positive rate: n/a.
Documented known gaps: 0. Documented known false positives: 0. Both stay in the denominators.

Full per-case output is in the job log.

Shard cpu-load-benchmarks-and-rest

Gate green: no category regressed against its committed baseline and no benign string is newly flagged.

Total recall: 378/386 (97.9%). Total false-positive rate: 23/370 (6.2%).
Documented known gaps: 8. Documented known false positives: 23. Both stay in the denominators.

Category	Recall	False positives
cmd_injection	38/46 (82.6%)	10/370 (2.7%)
cms_probing	36/36 (100.0%)	0/370 (0.0%)
code_injection	3/3 (100.0%)	0/370 (0.0%)
deserialization	18/18 (100.0%)	0/370 (0.0%)
dir_traversal	10/10 (100.0%)	0/370 (0.0%)
file_inclusion	16/16 (100.0%)	3/370 (0.8%)
file_upload	32/32 (100.0%)	0/370 (0.0%)
http_split	4/4 (100.0%)	0/370 (0.0%)
ldap	25/25 (100.0%)	0/370 (0.0%)
nosql	10/10 (100.0%)	0/370 (0.0%)
path_traversal	13/13 (100.0%)	0/370 (0.0%)
proto_pollution	8/8 (100.0%)	0/370 (0.0%)
recon	23/23 (100.0%)	0/370 (0.0%)
sensitive_file	16/16 (100.0%)	0/370 (0.0%)
sqli	38/38 (100.0%)	6/370 (1.6%)
ssrf	32/32 (100.0%)	4/370 (1.1%)
template	13/13 (100.0%)	1/370 (0.3%)
xml	4/4 (100.0%)	0/370 (0.0%)
xss	39/39 (100.0%)	0/370 (0.0%)

Full per-case output is in the job log.

Shard cpu-load-builtin-safety

Gate green: no category regressed against its committed baseline and no benign string is newly flagged.

Total recall: n/a. Total false-positive rate: n/a.
Documented known gaps: 0. Documented known false positives: 0. Both stay in the denominators.

Full per-case output is in the job log.

Shard hardening-canaries

Gate green: no category regressed against its committed baseline and no benign string is newly flagged.

Total recall: n/a. Total false-positive rate: n/a.
Documented known gaps: 0. Documented known false positives: 0. Both stay in the denominators.

Full per-case output is in the job log.