v0.6.1

Security

• rustls is updated from 0.23.43 to 0.23.45, which closes
  RUSTSEC-2026-0285:
  TLS 1.3 handshake messages were accepted across encryption level boundaries
  (CVSS 5.3). It reaches mdr through ureq, which is what fetches remote
  images over HTTPS, so it sits on the only network path mdr has.

  The advisory was published on 2026-09-14, the day the 0.6.0 pull request was
  opened, so no dependency update made before the release could have carried
  the fix. Binaries are statically linked: 0.6.0 ships the vulnerable version,
  and only a new release moves users off it.

• clap is updated from 4.6.6 to 4.6.7 in passing.

Lockfile only — no manifest change, and the resolver stays within versions
compatible with the declared MSRV of 1.95.

Full Changelog: v0.6.0...v0.6.1