v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243f, the pre-rewrite copy of 9c21983 with identical contents.

Commits:

• 0cd3af5 docs: load the en locale directly in Zod Mini
• 9d5e60f docs: import locales from zod/locales, not z.locales
• 34a626f docs: tighten the z.locales tree-shaking note
• 74304ce release: stage npm versions instead of publishing them (#6622)
• b2ef983 docs: add Code for Japan to bronze sponsors
• 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
• bacad51 docs: square the Code for Japan logo to match the other bronze tiles
• c42596b release: hold the run on the release-approval environment until the staged versions are approved (#6638)
• a2ba4a6 fix(types): declare record output and input as members, not base type arguments (#6645)
• a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
• 529f78d 4.6.6
• 9c21983 ci: stage at verbose so a failed OIDC token exchange says why