v3.5.6 — bug-bounty corpus grounding + 2FA bypass agent; Trendshift badge

- Fetched & analysed real public writeup corpora (Awesome-Bugbounty-Writeups,
  bug-bounty-reference); the technique distribution (XSS/RCE/CSRF/SSRF/2FA/…)
  validates the methodology agent's priorities. Added explicit 2FA/MFA bypass and
  SAML/SSO sections to bugbounty_methodology.
- New agent twofa_bypass_techniques (library 399): full 2FA-bypass playbook
  (rate-limit brute, reuse, response manipulation, step skip, null/default,
  backup/remember-me, race, disable-2FA IDOR, SSO side door).
- README: Trendshift badge.
- Version bumped 3.5.5 -> 3.5.6 across crates/app/installers/docs; RELEASE section.

TUTORIAL.md

@@ -1,4 +1,4 @@
-# NeuroSploit — Tutorial & User Guide (v3.5.5)
+# NeuroSploit — Tutorial & User Guide (v3.5.6)
 
 A complete, hands-on guide to installing, configuring and running NeuroSploit —
 the autonomous, multi-model penetration-testing harness.
@@ -40,7 +40,7 @@ You give NeuroSploit a **target** (URL, repo, app, or host/IP). It:
 
 1. **Recons** the target with real tools (curl/nmap/…).
 2. **Intelligently selects** only the agents whose preconditions match the recon
-   (it does *not* blindly run all 398).
+   (it does *not* blindly run all 399).
 3. **Exploits** in parallel — each agent works in a ReAct loop and must prove its
    claim with a **tool receipt** (raw output).
 4. **Validates** every candidate by **cross-model voting** (a different model
@@ -98,8 +98,8 @@ Agents **degrade gracefully**: if `rustscan` is absent they use `nmap`; if neith
 ### Verify
 
 ```bash
-neurosploit --version          # neurosploit 3.5.5
-neurosploit agents             # {"vulns":196,...,"chains":12,"total":398}
+neurosploit --version          # neurosploit 3.5.6
+neurosploit agents             # {"vulns":196,...,"chains":12,"total":399}
 neurosploit models             # all providers & models
 ```
 
@@ -535,7 +535,7 @@ built from SAST/dataflow), so uncertainty becomes *path reachability*, not state
 
 ## 13. The agent library
 
-`agents_md/` holds **398** markdown agents in categories:
+`agents_md/` holds **399** markdown agents in categories:
 
 | Category | Dir | Count | Purpose |
 |----------|-----|-------|---------|