v0.6.1

Fixed

• M4-T02 / M11-T01: complete the Hugging Face, Transformers, vLLM,
  OpenAI-compatible and PEFT integration interfaces and consume them in
  detection, lock resolution and metadata capture. Reuse the bounded AST scan,
  resolve adapters once, and avoid HTTP client construction during offline lock.
  Detect literal OpenRouter base_url arguments without retaining URLs or keys.
• M9-T01: align the local composite Action with the published Action's
  numeric audit exit code; validate all four CLI exits with successful and
  failed annotation steps.
• M9-T02: emit comma-separated GitHub workflow-command properties and keep
  the file and line from the same evidence item, preserving escaping.
• M7-T04: keep the invalid-candidate retry available after an endpoint rejects
  JSON mode; retain the final failed response and cap all requests at three.
• M11-T01: connect evaluation framework detection and task extraction to init;
  pre-fill sorted task candidates, including lm-eval YAMLs with custom tags, without
  executing tags or importing the framework. Authors still confirm selected tasks and
  metric implementations; secret-bearing and machine-specific task names are excluded.
• M8-T02: refresh CLI documentation for GitHub output and checklist templates, repair
  macOS temporary-directory aliases and Windows path separators in quickstart generation,
  fix captured terminal styling and width under GitHub Actions and Windows,
  render CLI documentation with a portable program name and console, show freshness diffs,
  and enforce all generated-document checks in ordinary CI and nightly again.
• M7-T04: include explicitly declared built-in manifest fields in discover's duplicate
  exclusion context, recognize source-snippet evidence, and discard evidence outside the
  sent input files while retaining the candidate's stable ID and lowering confidence.
  Clean returned candidates, failed raw responses and errors before persistence,
  remove unsafe fields/bindings and exact credential echoes, and preserve real
  filenames containing #L while normalizing generated snippet locators.
  Preserve valid relative config bindings containing ./ without allowing
  normalization to hide original credential, identity or traversal content.

Validation

• Local quality gate: 1,437 tests passed; redaction branch coverage remains
  100%; schemas and generated documentation are current. Export snapshots
  change only their two package-version markers.
• The maintainer deferred remote/GPU and unavailable exact judge-input
  validation for this patch; these resource checks are not fresh passes.
  Five-project full Gate A and available command/metadata matrices have zero
  new gold deltas; one real DeepSeek discover request passed independent
  candidate review and acceptance/audit checks. See val.md §8.7 and the
  patch session report.