v0.6.3

Fixed

• Shell injection in the release workflow. The GitHub Release step
  interpolated the changelog into a shell command, so backticks in release
  notes were executed by bash as command substitution. This broke the 0.6.2
  release after npm had already published, and meant anything landing a
  CHANGELOG entry could run arbitrary commands in CI. Notes are now written to
  a file and passed with --notes-file; no step output is interpolated into a
  shell anywhere in the workflow.