chore: prepare v0.6.2 provenance release

[cucuwang]

Summary

• bump all current release surfaces to 0.6.2
• add a fail-closed prepublish source gate requiring HEAD to equal the fetched origin/main commit
• document the 0.6.1 npm gitHead mismatch and keep v0.6.1 tag/Release intentionally absent
• keep scoring rules, output contracts, and runtime behavior unchanged

Why

The verified npm 0.6.1 tarball was published from the pre-squash PR commit (06b5de3) instead of the merged main commit (f26b51a). The source trees are identical, but the public provenance gate correctly rejected the mismatch. npm versions are immutable, so this PR fixes forward as 0.6.2 and prevents the same publishing path from recurring.

Validation

• Node 22.23.2: 9 test files / 159 tests, build, Action contract, npm audit (0 vulnerabilities), candidate pack
• Node 24.11.1: same gates
• both runtimes produced 56 files and SHA-256 c25a5c9daaee9f3c8c0fc412a794c8353dc14a38b70c8cd5a2da53c1ccbf28ed
• the new source gate rejects this unmerged branch because its HEAD differs from origin/main

Release boundary

This PR does not publish npm 0.6.2, create a Git tag, create a GitHub Release, change dist-tags, or deprecate 0.6.1. After merge, publication must be performed from the exact freshly fetched origin/main commit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.