docs(site): publish June 2026 landscape snapshot + refresh living landscape

[ojongerius]

Summary

Publishes the June 2026 landscape cycle to the public site, sourced solely from the June research delta (no re-research; missing facts flagged, not invented). No tracking issue exists for this cycle, so this is a summary rather than a closes #NNN.

Files changed (all under site/)

• New blog/agent-security-tooling-landscape-june-2026.mdx — the dated snapshot (in voice; leads with a cross-channel scenario; includes a Net Assessment). Mirrors the May post's location, frontmatter, and section structure.
• Rewrite ecosystem/landscape.mdx — the living doc brought to current truth (neutral/descriptive).
• blog/agent-security-tooling-landscape-may-2026.mdx — forward-pointer banner to June (see Notes).
• blog/index.mdx + astro.config.mjs — June entry in the post list and sidebar.

Strategic spine (public framing)

Receipts are table stakes; the differentiators are the W3C VC envelope and the out-of-agent trust boundary. Cross-channel correlation is framed as closing, never unoccupied — Pipelock now spans HTTP/WS/MCP in one firewall-scoped evidence log; Watchtower has it commercially/closed. Pipelock is framed as convergence/interop, not a firewall rivalry.

Key factual corrections carried into the living doc

• "Microsoft AGT / Agent Governance Toolkit" retired — the source repo is the Microsoft Agent Framework (orchestration + OpenTelemetry + Purview), not an audit/signing toolkit. Removed from audit/governance comparisons and the primitives-convergence table.
• Asqav reclassified server-side/custodial (not in-agent).
• Pipelock updated to v2.6.0: Audit Packet v0, Go/TS/Rust verifiers, RFC 8785 JCS, in-toto/DSSE + SCITT, 3-UID containment, operation-level egress, SPIFFE.
• InALign adds a W3C PROV graph + optional external anchor; nono at v0.55.0.
• "Agent Wall" removed as unverified (agentwall.tech is a different product; repo not re-located).
• New adjacent entrants added (AgentROA, Nelson DRP, Marques/Asqav profile, MetaComp StableX KYA, SwarmSync VCAP, CAP-SRP, OpenKedge); standards window + EU AI Act Digital Omnibus refreshed (Article 12 still legally live at 2 Aug 2026).

Validation

• pnpm build passes (20 pages; June page renders at 59 KB). The only build blocker is environmental — rehype-mermaid needs a Playwright headless-shell build (1228) not provisioned here (only 1194 is installed); validated by temporarily pointing mermaid at the installed Chromium, then reverting. No mermaid in the new/changed files.
• The pre-push test hook ran no SDK suites (correctly path-filtered to the docs-only change set once origin/HEAD was set).

Notes / judgement calls

• May post banner. Adding a forward-pointer banner to the May snapshot is the established convention (April carries the same banner) and was a stated acceptance criterion in the May cycle (docs(blog): publish May 2026 landscape post + living landscape doc #554). It's one line of wayfinding, not a reframing of the May analysis. April was left untouched (it already routes forward via May → June). Revert trivially if you'd rather keep priors strictly frozen.
• OG card. June omits a bespoke ogImage (rides the default /og.png). A bespoke og-blog-landscape-june-2026.png is a follow-up.
• OPERATIONS.md left untouched (per decision — it tracks the active code DAG, not docs/positioning refreshes).

Acceptance criteria

• June snapshot created, mirrors May structure, includes Net Assessment
• landscape.mdx (living) rewritten to current truth
• Public blog post authored in voice, location mirrors prior posts
• No "nobody does this" framing; correlation framed as closing
• Load-bearing URLs/identifiers (/context/v1, issuer DID, canonical paths) untouched
• OPERATIONS.md left as-is (work not tracked there)