* Release 0.6.1

Correctness fixes across validation, containers and the event payloads, plus a
CJS/UMD artifact that actually loads.

Validation
- Async validators are sequenced per field: a superseded run is discarded and a
  rejected one withdraws its own errors instead of becoming an unhandled
  rejection.
- clearValidators() cancels validation still in flight and announces the
  validity change it causes.
- A validity change reaches the enclosing Group or List even when no value
  changed, and a container announces at most the net transition per operation.
- One ValidationError instance may be handled by several validators.
- A validator message given as a Ref or computed keeps its reactivity.
- Constructor-supplied validators run exactly once, over the constructed value.

Containers
- A Group constructed with parameters that carry no value keeps its members'
  values; an explicit null still clears them.
- The reported old value of ValueChangedAction is the real previous value on
  Group and List.
- ListItemAddedAction announces the position each item occupies, padding items
  included, and insert() resolves a negative index the way splice does.
- clone() reads value and originalValue by what the caller supplied.

Conditions
- Statement.evaluate() returns a boolean for every operator, so conditional
  actions no longer fire on non-transitions, and NOT_IN is the negation of IN.

Packaging
- The CJS/UMD build requires lodash instead of the ESM-only lodash-es, so
  require() works on every supported Node and under Jest. lodash and lodash-es
  are dependencies, vue is the only peer, engines.node declares >= 18, prepack
  builds the package and package-lock.json is tracked.
- The UMD global is DynamicFormsVueForms.

Documentation is verified against the sources, and the audit backlog in todo.md
records only what is still open.

* Do not let a failed validation read as a passing one

An asynchronous validator whose promise rejects reached no verdict, and the
field then reported itself valid: a uniqueness check that could not reach its
server let the form submit. A rejection from the current run now leaves the
field invalid with one error saying validation could not be completed, which
the next successful run of the same validator withdraws. A superseded
rejection is still discarded silently, and the promise chain ends in a catch,
so a throwing ValidChangedAction handler cannot turn a verdict into an
unhandled rejection.

Group.value = null clears a nested List. A List ignored any assignment that
was not an array, so a nested list kept its rows while every sibling field was
emptied.

A container's deferred validity climb runs from the same finally that restores
the flag, so a handler that throws mid-assignment cannot leave the container
announcing nothing.

CI installs with npm ci, which the tracked lockfile now allows, and the
lockfile carries the release version.