lockdocs 0.6.0

• Ready for crates.io. The two crates, lockdocs-core and lockdocs, carry full package metadata, a small include list, and a versioned path dependency, so cargo publish --dry-run --locked passes in dependency order. cargo binstall lockdocs downloads the matching GitHub release binary. The release workflow publishes them through crates.io trusted publishing (no token) once an owner sets CRATES_IO_PUBLISH_ENABLED and the trusted-publisher records exist.
• Hybrid search is no longer worse than keyword search. The fusion is now keyword-first: on package files weighted reciprocal rank (90% keyword ranking with all docs boosts, 10% embedding ranking) replaces the min-max score mix that let the embedding outvote exact API-name matches; when upstream docs are indexed the normalized score mix is kept (rank-only fusion buried pages like tokio's select.md, 91 vs 96 of 105 fetched). The embedding is skipped when one entry leads by at least 2x. On the 105-question benchmark (package files, no upstream) hybrid goes from 60 to 64 of 105 against 59 for keyword-only, with the held-out set at 8/18 (was 6/18, keyword 8/18).
• Hybrid search is as light as keyword search. A query reads only its own tokens' rows from the model file (positioned reads) instead of loading the 32 MB weight table: median CLI peak RSS 48 MB to 18 MB, median latency 42 ms to 18 ms (keyword-only 12 ms). The full model loads only when an index is built.
• CI floor. The benchmark job fails when hybrid scores below keyword-only on the same docs (package-only or prefetched); the package-only hybrid floor rises from 60 to 62.
• lockdocs Pro: the upgrade report. lockdocs upgrade <pkg> <ver> (also docs --pkg <pkg> --upgrade-to <ver> and the docs tool's upgrade_to argument) lists the APIs your project calls that were removed, renamed, re-signed or deprecated between the pinned version and the target, with call sites and migration-guide sections. It is the paid plan, Pro, US$120 per seat per year, unlocked by an offline-verified licence from the mcp-kit licence capability 0.5.0: lockdocs licence status and lockdocs licence activate <token>, or LOCKDOCS_LICENCE_TOKEN in CI. Without a licence the CLI exits 3 and an MCP call returns a normal result with pro_required; a licence in its last 30 days adds a renewal line to the report. The issuer key in crates/lockdocs/src/pro.rs is a placeholder until it is issued, so no token verifies yet. Everything else stays free under MIT.