Prepare @workit/core 0.6.0 candidate policy release

[AdmilsonCossa]

Summary

• add the opt-in @workit/core/candidates subpath with deterministic firstAcceptable selection
• add provider-neutral failure taxonomy, semantic quality decisions, shared retry/deadline policy, and bounded redacted evidence
• preserve the root API and zero-runtime-dependency boundary
• prepare package metadata and changelog for 0.6.0
• make unresolved evidence release-blocking and resolve REL-011 with a real Oryn canary

Compatibility

• semver minor release
• existing root exports remain unchanged
• candidates is opt-in through @workit/core/candidates
• ESM, CommonJS, strict TypeScript, unsupported-runtime, installed-package, Node, Bun, Deno, Worker, and framework contracts are covered

Oryn canary evidence

• packed @workit/core@0.6.0 tarball exercised inside an isolated Oryn worktree
• real Oryn route: ollama, glm-5.2:cloud primary, configured fallbacks
• first real candidate quality-rejected; second real candidate accepted
• bounded evidence retained two decisions, dropped zero, and redacted the secret probe
• Oryn durable runtime recreated; replay made zero operation/provider calls
• daemon receipt round-trip succeeded
• controlled shared-retry-budget, aggregate-deadline, cancellation, and requires_user_input stop scenarios passed
• receipt binds WorkIt commit, Oryn commit, canary script SHA-256, and tarball SHA-256
• Oryn local entitlement/storage warnings and test limitations are retained in the receipt

Verification

• local npm run verify: passed end-to-end
• local coverage: 100% statements, branches, functions, and lines
• tests: 31 files, 410 tests passed
• evidence ledger: 59 claims, 57 proven, 2 product decisions, zero blockers
• security and production vulnerability audit: passed, zero findings
• SBOM, API, candidates API, size, performance, leak, soak, exporter stress, package consumer, claims, public proof, worker contract, release policy, and pack dry-run: passed
• GitHub CI and coverage: passed
• CodeQL: passed
• use-cases site build: passed
• all six PR commits are SSH-signed and GitHub-verified

Release status

• implementation and public contract documented
• bounded edge, exploit, performance, runtime, and installed-consumer evidence
• REL-011 real Oryn provider/durable-idempotency canary
• trusted SSH signing key rotated and registered
• CI, coverage, CodeQL, and site checks green
• merge through this PR
• create and verify signed v0.6.0 tag from main
• run the provenance workflow in dry-run mode from the verified tag
• publish only after the tag-bound dry run is green

No tag or npm publication is included in this PR.

Repository hygiene

• released articles were not changed
• local docs/ remains ignored
• the redacted canary receipt is a single direct file in the existing evidence ledger; generated captures remain ignored
• Oryn's dirty main checkout was not modified; the canary ran in an isolated worktree