chore: prepare v0.6.1 release

[cucuwang]

Summary

Prepare the artifact-bound release gate hardening from #4 as patch release 0.6.1.

• aligns the npm package, CLI, root and compatibility Actions, Claude plugin metadata, CI tarball paths, README examples, and copyable sample on 0.6.1;
• promotes the hardening notes from Unreleased to the 0.6.1 changelog section;
• updates the v0.6 release guide and rollback target for the patch release;
• makes the public verifier derive the exact version and Git tag from package.json, while keeping the v0.6.0 scoring corpus and methodology contract unchanged.

Compatibility

• no scoring rule, rule weight, public JSON field, Action input, or Action output changes;
• the v0.6.0 fixture and methodology contract remains the scoring contract for the 0.6.x line;
• the Action's default npm package changes from aeoptimize@0.6.0 to aeoptimize@0.6.1 only after the matching npm package and immutable Git tag are published separately.

Validation

Run from clean commit 06b5de329285d661538280caf5fd50241be6dc29:

Gate	Node 22.23.2 / npm 10.9.4	Node 24.11.1 / npm 11.19.0
Vitest	8 files, 156 tests passed	8 files, 156 tests passed
TypeScript build	passed	passed
Action contract	passed	passed
npm audit	0 vulnerabilities	0 vulnerabilities
candidate pack	55 files	55 files
candidate SHA-256	2279acd3ce779ad68dcbef2e3cef7d4f16297aef3b59d3a82ceb0f774aab27fb	same

npm publish --dry-run --json completed the full prepublishOnly candidate gate and produced metadata for aeoptimize@0.6.1 without publishing.

The fail-closed public verifier currently reports the expected four pre-publication failures:

• npm latest remains 0.6.0;
• npm does not contain exact version 0.6.1;
• v0.6.1 does not exist;
• the v0.6.1 GitHub Release returns 404.

Release boundary

This PR only prepares release metadata and candidates. It does not publish npm content, create or move a tag, create a GitHub Release, change npm dist-tags, or alter repository rulesets. After merge, the complete gate must run again against the merge SHA before each external mutation is authorized separately.

Review checklist

• All public version surfaces resolve to 0.6.1.
• The v0.6.0 scoring corpus and methodology remain unchanged.
• Node 22 and 24 candidates remain byte-identical.
• Prepublish verification builds and installs the exact candidate tarball.
• Public verification fails closed until publication, tag, and Release exist.
• Rollback instructions restore npm latest to 0.6.0 without moving an existing tag.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.