v0.6.0

Added

• The thirteen tools that only read (list_zones, get_zone,
  list_dns_records, get_dns_record, list_request_header_rules,
  list_response_header_rules, list_url_rewrite_rules, list_page_rules,
  list_waf_rules, get_zone_analytics, get_top_pages,
  get_traffic_by_country, get_security_events) publish
  readOnlyHint: true. A gateway uses it to decide whether an invalid optional
  argument may be dropped or must refuse the call (crunchtools/constitution#35).
• Tests pin every registered tool into READ_ONLY or WRITES, and check that
  a read-only tool sends only GET requests, except the four analytics tools,
  whose one POST must be a GraphQL query to /graphql.

Changed

• Inherits constitution v1.22.0; the workflow pins and the pre-commit hook rev
  move with it.
• Constitution is now a v1.18.0 manifest: only repo-specific rules stay in
  .specify/memory/constitution.md; fleet and profile rules apply by reference.
• Constitution validation is pinned via constitution.yml.
• Dependabot auto-merges GitHub Actions minor and patch updates.

Fixed

• The Containerfile version label said 0.5.0 through the 0.5.1 release; it
  carries the release version again.