v0.6.1

Fixed

• Host invokes work in consumer worklets (#268): request ids no longer
  read globalThis.crypto, which Bare does not provide, so every
  invokeOnHost (photo picker, camera) threw before it was sent unless the
  worklet entry installed a Web Crypto shim. Randomness is now injected
  through a Platform object: the worklet runtime uses bare-crypto, and
  createProtocolMessenger(send, { platform }) defaults to Web Crypto and
  throws (never falls back to Math.random) when none exists. Consumer
  shims that set globalThis.crypto for this can be removed.
• Failed host calls answer instead of hanging (#268): a failed host
  capabilities query now returns a HOST_ERROR response, and any invoke
  whose routing throws gets an error response. Before, the web caller got
  nothing and waited out its timeout.

Changed

• Android build toolchain (#271): the build moved to AGP 9.5 and Gradle 9.6,
  and AGP's built-in Kotlin replaces the org.jetbrains.kotlin.android plugin.
  The published AAR is now built with a different Kotlin compiler.
• SwiftPM binary pin (#270): Package.swift resolves BareKit by pinned
  url and checksum on main, not by a local path.