• fix: Keep mutationTargets on ServiceData for runtime resource protection while omitting them from FunctionalFlow reports
• fix: Disable runtime URL parameter enrichment in FunctionalFlowFuzzer so explicit step path parameters are preserved
• fix: Protect explicit step body fields from correlation overrides and omit mutation targets on functional flow steps
• feat: Replace expect.where with expect.that, support shorthand save lists, and avoid merging optional GET query params in FunctionalFlowFuzzer
• feat: Enhance FunctionalFlow and SecurityFuzzer with cross-step/cross-field capabilities and add stateful replay and flow export to ReplayCommand
• feat: Add CATS AI agent skill suite and 'cats init --skills' installer for Devin, Codex, Claude Code, OpenCode, and Cursor