test: enforce v0.6.0 release gates

[cucuwang]

Summary

This change makes the v0.6.0 release criteria reproducible before publication.

• adds a versioned fixture corpus with positive, negative, and false-positive boundary cases for all 14 scored rules;
• adds a copyable end-to-end GitHub Action sample and validates its output contract;
• adds a fail-closed public verifier for npm metadata, candidate tarball SHA-256, optional gitHead consistency, all three CLI aliases, the Git tag, and the GitHub Release;
• documents release acceptance, public readback, and rollback steps;
• labels the methodology as the v0.6.0 scoring contract and removes the speculative release date from the changelog;
• includes the new fixtures, sample, release guide, and verifier in the published package.

Why

The earlier candidate was packaging-correct, but the gates named in ROADMAP.md were not all backed by public fixtures and an end-to-end sample. This patch closes that evidence gap without publishing, tagging, or creating a release.

Validation

The branch was tested from clean git archive exports on both CI matrix versions:

Gate	Node 22.23.2	Node 24.11.1
npm ci	passed	passed
Vitest	8 files, 110 tests passed	8 files, 110 tests passed
TypeScript build	passed	passed
action/test-contract.sh	passed	passed
npm pack --dry-run	passed, 54 files	passed, 54 files
npm audit --audit-level=high	0 vulnerabilities	0 vulnerabilities

Additional candidate evidence:

• independent Node 22 and Node 24 packs were byte-identical and produced SHA-256 f5ea2dbb4d15732fc095b7d8e8805b9381fb007f81243ee36e2caad4fa1d58c1;
• a clean isolated consumer installed the packed artifact with scripts disabled;
• aeoptimize --version, aeo --version, and aeo-cli --version each returned 0.6.0;
• git diff --check passed;
• npm publish --dry-run --json accepted the preserved tarball as aeoptimize@0.6.0, targeting the public registry with latest, without publishing;
• remote comparison: three commits ahead of main, zero behind; 15 files changed, 919 additions, 7 deletions.

Compatibility notes:

• no scoring rule, rule weight, JSON field, Action input, or Action output is renamed or removed;
• the release verifier intentionally adds a required candidate SHA-256 argument so that a different npm tarball cannot pass as the tested candidate;
• the changes are release evidence and documentation only; runtime scoring behavior is unchanged.

Release boundary

This pull request does not publish v0.6.0. npm latest remains 0.5.3, and the pre-release public verifier is expected to fail closed until publication, tag, and GitHub Release are completed and verified.

Review checklist

• Public corpus covers all 14 scored rules and boundary behavior.
• GitHub Action sample is copyable and exercised by CI.
• JSON automation fields remain stable and machine-readable.
• Package contents include the fixtures, sample, release guide, and verifier.
• Public verification requires the reviewed tarball SHA-256 and rejects a conflicting npm gitHead when that optional field is exposed.
• Changelog and methodology make no unsupported release claim.
• GitHub CI passes on the PR head.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.