chore(release): prepare v0.6.4

[jo-hnny]

Summary

• add matching 0.6.4 entries to CHANGELOG.md and CHANGELOG-zh.md
• cover all user-visible changes merged after v0.6.3, including identity and credential workflows, lifecycle waiting, update checks, progress feedback, improved error guidance, API metadata updates, and non-root installation support
• keep the required release-note sections and ordering used by the tag-triggered release workflow

Release highlights

• add 17 agr identity and agr credential workflow commands
• add operation-aware --wait support across Instance and Tool lifecycle commands, including deletion
• add agr update, cached background update notices, create-command progress spinners, and inline fix suggestions
• expose instance pause --memory and instance resume --timeout through refreshed AGS API metadata
• install to $HOME/.local/bin without implicit sudo when /usr/local/bin is not writable

Validation

• bash scripts/changelog.sh validate-pair 0.6.4
• bash scripts/changelog.sh validate-release-notes-pair 0.6.4
• bash scripts/changelog.sh extract 0.6.4 /private/tmp/agr-v064-release-notes.md
• go run ./cmd/internal/cobragen check
• go test ./internal/apimeta/... -count=1
• go test ./...
• git diff --check

After this PR is merged, tag its exact merge commit as v0.6.4 to trigger the release workflow.

[KayIter]

Reviewed the v0.6.4 changelog updates. I do not see any blocking customer-facing or open-source disclosure issues in the release notes. The changelog/release-note pair validation passes, and GitHub CI is green. Approving.