v0.6.1

Completes the partial 0.6.0 release. 0.6.0 published 31 of 32 npm packages but
could not publish @blackbelt-technology/pi-dashboard-eng-disciplines — its 0.6.0
version string was burned by an earlier independent publish + unpublish — which
blocked the Electron installers and the GitHub Release. 0.6.1 re-cuts every
workspace at a fresh, unburned version so all packages ship consistently and the
installers + GitHub Release are produced. No functional changes beyond the
release-pipeline fixes below; see [0.6.0] for the full feature set.

Fixed

• Release pipeline hardening (publish.yml). Pinned the publish job's npm to
  11.12.1: npm@latest now refuses the transitive @electron/node-gyp git
  dependency (EALLOWGIT, via @electron/rebuild ← @electron-forge/core),
  breaking npm ci; npm@11.5.1 is too old and drops the lightningcss-linux-x64-gnu
  optional native dep (client vite build fails). 11.12.1 resolves both while keeping
  OIDC trusted publishing. Added a repository field to pi-dashboard-bus-client
  and pi-dashboard-kb so their OIDC provenance bundles validate (was E422).
  Wrapped the per-package publish loop in set +e/set -e so a single failure no
  longer aborts before the Trusted-Publisher gap report enumerates.
• Windows introspection smoke. Dropped an orphaned defaultGetCmdline probe
  left behind when editor-pid-registry.ts was removed (kept the still-valid
  isVirtualMachine + no-wmic-leak checks).

---

First-launch unblocking (unsigned binaries)

The Windows installers and macOS DMGs are not yet code-signed / notarized.
Both OSes will block first-launch with a security warning. These are not
malware — the artifacts are the exact ones produced by
.github/workflows/publish.yml
against this tag. Pick whichever workaround fits your workflow.

Tracking: Authenticode signing → change windows-authenticode-signing;
macOS notarization → change macos-notarization (planned). This section
will shrink and eventually disappear as each lands.

Windows — SmartScreen warning

SmartScreen will show "Windows protected your PC" the first time you
run any .exe artifact (Setup, or any .exe extracted from a ZIP).

Option A — at the SmartScreen dialog:

1. Click More info.
2. Click Run anyway.

Option B — pre-clear the Mark-of-the-Web:

1. Right-click the downloaded .exe (or the .zip) → Properties.
2. At the bottom of the General tab, tick Unblock next to
   "This file came from another computer...".
3. Click OK and run as normal.

For ZIP archives, unblock the archive itself before extracting so
the contained .exes inherit the cleared zone.

macOS — Gatekeeper / quarantine

macOS will refuse to launch the app on first run with "PI Dashboard
cannot be opened because the developer cannot be verified" or silently
quarantine it.

Option A — control-click the app:

1. Open the DMG and drag PI Dashboard to Applications.
2. In Applications, right-click (or Control-click) PI Dashboard →
   Open.
3. Click Open in the confirmation dialog. Subsequent launches are
   unrestricted.

Option B — clear the quarantine attribute from the terminal:

xattr -d com.apple.quarantine "/Applications/PI Dashboard.app"

If the DMG itself is being blocked, clear it on the mounted volume
before copying:

xattr -d com.apple.quarantine "/Volumes/PI Dashboard/PI Dashboard.app"