Next patch release. Carries the three P0 fixes v2.5.4 shipped without: #767 (self-scan gate), #771 (METADATA cut-short loses findings), #772 (unknown --redaction-strategy / FERRET_PRECOMMIT_EXIT_ON silently defaults).