Close out the v0.6.0 publication - #243

v0.6.0 is live on all six surfaces. This moves the repository from describing 0.5.0 as published
to describing 0.6.0, and applies the wording packet approved on 2026-07-31 for exactly this moment.

Every claim was verified against the live registries before landing: three crates on crates.io
(none yanked), the wheel and sdist on PyPI byte-identical to the local build, the npm tarball
downloaded and its vendored binaries confirmed byte-identical to the release archives with the
darwin binary reporting `ethos 0.6.0`, and the GitHub Release marked latest with 16 assets whose
checksums match the promotion record.

Corrects a live public surface. The release body still read "This release prepares:", "The
intended v0.6.0 release surfaces are:", and listed both checksums as "pending — recorded here from
the approved archives before publication". docs/releases/v0.6.0.md is the canonical body, so it is
rewritten to published tense with the four real digests and pushed to the release. This CHANGELOG
already records the identical defect at v0.5.0, whose body read "release candidate" until it was
retrofitted; it recurred because release notes are written before publication and nothing rereads
them at publication time.

The notes now also state that the eight published *.inventory.json sidecars still read
draft_not_release_ready. write_release_artifact_inventory.py hard-codes that and cannot describe an
approved artifact, so without the caveat the machine-readable evidence attached to the release
contradicts the release.

Retires test_v0_6_0_version_activation.py for test_version_activation_lockstep.py, which reads the
activated and published versions from the ledger. It was the sixth hand-written generation of one
gate and its premise is now false. Both durable assertions survive: core metadata in lockstep, and
the npm payload's four version fields moving as one set with a recorded boundary exception — the
guard that forced 1d23604's revert, which retiring without replacement would have reopened.

test_public_surface_posture.py and test_execution_status.py now derive every version literal from
the ledger instead of transcribing it, and the posture gate gains exact-set assertions that no
install command in README.md names any version but the published one. The retired module held the
only negative assertions against stale install strings.

The published GitHub Action pin follows the ledger to v0.6.0. actions/verify/README.md claimed the
Action downloads "the fixed v0.4.0 Linux x64 release archive" — three releases stale, asserted by
nothing — and is now version-neutral.

The closeout record corrects a prior false claim rather than repeating it: the ledger declared
ethos-package-*-0.4.0 and -0.5.0 closed out against a record that never mentions package tags, and
those six tags do not exist on either side. check_release_state.py string-matches declared names
against release.rust_crates and never consults git, which is how it survived two releases. The
0.6.0 triple is created here. The record also binds two source commits rather than one, because the
npm payload landed two commits after the tag, and states plainly that consumer acceptance is bound
to 0.5.0 bytes and that release-prep §5.1 was removed rather than satisfied.

make release-gates exits 0, including release-live-state-check against the real registry. npm test
and the Action contract pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: docushell-dev <hello@docushell.com>