v0.6.2 — close the gaps the last audit did not look for

A packaging release, again. The schema is still byte-identical and the $id still names
v0.4.0. 0.6.1 fixed the defects an audit of the package found; this one fixes the ones that
audit had not looked for, and closes the coverage gaps that let the first set through.

Fixed

• 35 links in the shipped documents pointed at files that are not shipped. The package is a
  subset of the repository, so a relative link into examples/ reads fine on GitHub and is dead for anyone
  reading the same file in node_modules. npmjs.com hides this for the README — it rewrites relative
  links against the repository — but only for the README, and only on that page.

  Fixed from both ends. files now ships the documents a consumer or a would-be contributor
  plausibly wants offline: COMPARISON.md, CONTRIBUTING.md, GOVERNANCE.md, CODE_OF_CONDUCT.md,
  SECURITY.md and SUPPORT.md. Links to things a schema package has no business shipping —
  examples/, assets/, .github/, tests/, experiments/, the 39 KB decision record and the
  maintainer-only RELEASING.md — are now absolute. The tarball grew from 61 KB to 77 KB, which is
  the price of the docs being readable where they are installed.

• npx open-predicate printed npm's could not determine executable to run. The unscoped name
  is a deprecated placeholder with no code, so npm had no bin to run and said so in its own terms,
  which tells someone following a stale instruction nothing. It now carries a single executable
  whose only job is to name the scoped package and exit non-zero. The recipe in
  RELEASING.md is updated
  to reproduce it, and records that npm deprecate marks a version rather than a package, so the
  deprecation has to be re-applied after each publish.

Added

• The packed artifact is now tested under every package manager, on every platform that links a
  bin differently. The 0.6.0 no-op was a symlink bug, and package managers disagree about
  symlinks: npm and yarn classic symlink, pnpm writes a shell shim, Yarn Berry's PnP has no
  node_modules at all, and Windows gets .cmd wrappers that pass the real path — which is why the
  bug never existed there. The release gate added in 0.6.1 only ever proved the npm-on-Linux case.

  .github/scripts/smoke-packed-artifact.sh
  installs the tarball and drives the bin, require(), the documented ESM import attribute and
  ./generate under a named package manager, and CI runs it across npm, pnpm, yarn, yarn-pnp and
  bun on Linux plus npm on Windows and macOS. The release workflow calls the same script rather than
  keeping a second copy of the logic.

• tests/packaging.test.mjs asserts the claims a tarball can break. Every relative link in a
  shipped document resolves to a shipped file; no shipped document links outside the package; the
  bin is shipped, non-empty and still has its shebang; and the declared Node floor is the one the
  code actually needs. It reads the file list from npm pack --dry-run --json rather than
  extracting a tarball, so it needs no tar and runs on Windows unchanged.

• CI declares permissions: contents: read. It had no permissions block at all, so it
  inherited the repository default while release.yml had been careful to take none.

---

Upgrading: npm i @open-predicate/open-predicate@0.6.2. Nothing to migrate — the schema is
byte-identical to 0.6.0 and the $id is unchanged, so any $ref or vendored copy stays valid.

Full changelog: https://github.com/OpenPredicate/open-predicate/blob/v0.6.2/CHANGELOG.md