v0.6.0 — "Chain of Trust"

A governance and transport-security pass: approvals now bind to the exact
operation and expiry a reviewer saw, standalone installers verify against a
digest pinned in the release tag instead of mutable release assets, and the
shared authority service gets an application-level access token — plus two
approval-reuse gaps closed in orchestrator grants and task takeovers.

Security

• Breaking: approvals for contract publication and approval-gated
  invocations now carry a SHA-256 subject digest and an expiry; existing
  action-only approvals no longer authorize these operations and must be
  renewed. See RFC 0025.
• Breaking: production agent-comms-server startup now requires
  AGENT_COMMS_AUTHORITY_TOKEN, alongside existing TLS and signing-key
  requirements. See RFC 0026.
• Breaking: standalone installers now require an exact release version,
  authenticate the downloaded verifier against six platform digests
  committed in that protected tag, and bind Sigstore verification to the
  exact requested tag. A separately installed Cosign binary is still not
  required.
• Orchestrator-grant and task-takeover approvals are now ID-scoped and
  single-use: a matching approval is consumed once used and can no longer be
  replayed to re-authorize the same grant or takeover indefinitely. See
  RFC 0023 and
  RFC 0024.
• Authority SSE streams now use a dedicated bounded connection pool so
  long-lived stream holders can no longer exhaust health-check or mutation
  capacity.
• Updated google.golang.org/grpc to 1.83.1 (fixes a high-severity HTTP/2
  DATA-frame-fragmentation heap exhaustion) and fast-uri to 3.1.7 (fixes
  two high-severity SSRF/host-confusion issues from percent-decoding and
  IDN-canonicalization handling).

Full technical detail is below and in CHANGELOG.md.

---

Full Changelog: v0.5.0...v0.6.0