Unpin v0.6.2

Unpin v0.6.2

v0.6.2 makes a successful bulk toggle produce one authenticated transaction
backup instead of a separate full backup for every selected item.

Highlights

• One bulk operation now leaves one restorable backup bundle.
• The bundle retains one pre-write snapshot per physical resource. A shared
  Codex config.toml, for example, is captured once even when many MCPs and
  skills are changed together.
• Every changed item reports the same bundle ID, and restoring that bundle
  returns every affected resource to its pre-batch contents.
• Provider-pinned MCP servers keep their hard boundary: a bundle spanning
  multiple providers is available only through an unscoped MCP connection.
• Restore plans use schema version 3 to bind complete provider coverage. Plans
  generated by v0.6.1 must be re-planned after upgrading; existing
  authenticated backups remain restorable in v0.6.2, while v0.6.1 cannot read
  the new bundled backup format.

Verification

• The release candidate must pass the full local provider matrix and live Pi
  and OpenCode host validation from the exact candidate commit, in addition to
  required CI and locked workspace checks.
• The release workflow verifies the GNU/Linux artifact's GLIBC_2.35-or-older
  symbol ceiling and runs --version and --help in Debian 12.
• Each archive has GitHub build provenance, a CycloneDX SBOM, and a
  workflow-generated SHA256SUMS trust root. Verify a downloaded archive with:

shasum -a 256 -c SHA256SUMS
gh attestation verify unpin-v0.6.2-x86_64-unknown-linux-gnu.tar.gz \
  --repo IgorArkhipov/unpin \
  --source-ref refs/tags/v0.6.2 \
  --signer-workflow IgorArkhipov/unpin/.github/workflows/release.yml

For setup and security guidance, see the
onboarding guide
and security policy.