v0.6.0 — native popover + CSS anchor positioning, a11y round 2

Floating panels: native [popover] + CSS anchor positioning (#22–#30)

Every floating panel — popover, tooltip, hover card, dropdown menu (+ submenus), select, combobox, context menu, menubar, navigation menu — now uses the native Popover API and CSS anchor positioning (Baseline 2026: Chrome 125+, Safari 26, Firefox 147) instead of static absolute positioning:

• Panels respect the viewport: position-try-fallbacks flips them to the opposite side at screen edges, live while scrolling — matching shadcn/Radix behavior, with zero JS and zero dependencies.
• Top-layer rendering escapes overflow: hidden ancestors (the Radix-portal equivalent); stacking z-index hacks are gone.
• Less JavaScript: popover/dropdown/select/combobox get native or simplified dismiss handling; combobox's updatePopoverWidth() + resize listener are deleted outright (anchor-size(width) in CSS); context menus clamp to the viewport.
• Tooltip keeps its pure-CSS :hover/:focus-within reveal, gaining anchor positioning + edge flipping without the popover attribute.

Breaking-ish (DOM contract): panels now carry a popover attribute instead of the pk-hidden class, and are position: fixed in the top layer. Host CSS that targeted panel positioning (or pk-hidden on panels) needs the same treatment. Public Ruby APIs (side:, align:, delays) are unchanged. Combobox's undocumented min_popover_width Stimulus value was removed (now width: max(anchor-size(width), 15rem) in CSS).

Accessibility & correctness round 2 (#20, #21)

• APG keyboard models: menubar + context menu navigation, tabs/accordion, roving focus; combobox/command ARIA 1.2 wiring with aria-activedescendant + live result counts; command dialog + sheet/drawer real modality (focus trap, scroll lock, focus return, double-open guards); dialog accessible-name wiring; input OTP labelled group + numeric paste filter; aria-sort + selection/pagination announcements on data table; toast focus-pause + previously-dead on_dismiss:/on_auto_close: callbacks; new tooltip controller (aria-describedby, WCAG 1.4.13 Escape dismiss).
• Correctness: Switch ARIA/markup rebuild, attr-clobbering fixes (ThemeToggle, AlertDialogCancel), gemspec cwd-relative glob (foreign-cwd builds were silently empty), select aria-activedescendant fixes, calendar UTC/frozen-date + spurious-change fixes, CSS.escape'd data-table column keys, ResizablePanel numeric coercion, standalone-require crash fix.
• CI rubocop gate is real now (all offenses cleared).

40 Stimulus controllers, 263 tests green. Verified end-to-end in Chrome and WebKit 26.5 (Playwright, trusted input) across all affected gallery pages.