v0.6.0

Added

• TOML config loading with XDG user-global layering:
  $XDG_CONFIG_HOME/kyoso/config.toml or ~/.config/kyoso/config.toml, then
  project kyoso.toml.
• Unknown-key detection for user-global config.toml; security-sensitive
  unknown settings fail closed by default, with --allow-unknown-config as an
  explicit opt-out.
• Project TOML scope validation for repository-owned settings, including
  additive workspace.deny and tightening-only security/network keys.
• kyoso doctor now reports global, project TOML, and legacy TypeScript config
  layers.

Changed

• kyoso init now writes kyoso.toml.
• --config now fails when the specified file does not exist.
• Default Claude agent timeout raised from 240s to 300s; dogfooding traces
  showed frequent reviews truncated at the previous limit.
• Repository dogfooding config and examples now use TOML.

Deprecated

• kyoso.config.ts remains supported through the existing trust flow, but emits
  a deprecation warning. When both kyoso.toml and kyoso.config.ts exist,
  TOML takes precedence.

Commits

• docs(readme): add ensemble illustration and model docs links (783d0a3)
• feat(config): raise default Claude agent timeout to 300s (15ae71f)
• feat(config): fail closed on missing --config and unknown security-sensitive keys (d76e9fa)
• chore(release): add 0.6.0 changelog (472dcc5)
• build: bump version to 0.6.0 (46ec6a3)
• feat(config): add TOML config with XDG layering and deprecate kyoso.config.ts (0ece184)

Full Changelog: v0.5.0...v0.6.0