URLCode 0.6.1

What's Changed

• Add revision-pinned agent catalog by @jimhoyd in #674
• build(release): Release prepares the bump branch; the publisher becomes Publish by @jimhoyd in #675
• build(release): name the workflows Create release and Publish release by @jimhoyd in #679
• fix(mcp): validate Origin and MCP-Protocol-Version; document the exact mount URL by @jimhoyd in #685
• fix(core): explain_error suggests list_capabilities, not its legacy alias by @jimhoyd in #683
• fix(forms): validate date and datetime-local field submissions by @jimhoyd in #684
• Add component-owned agent tooling descriptors by @jimhoyd in #686
• fix(core): allowlist artifact package.json keys and restore node_modules on a refused add/remove by @jimhoyd in #688
• Expose installed add-on agent tooling to MCP by @jimhoyd in #690
• feat(mcp): declare title and tool annotations by @jimhoyd in #687
• Add agent references for shipped extensions by @jimhoyd in #692
• Give extension requests and hooks a request context: route env and request id by @jimhoyd in #691
• feat(forms): date and datetime-local minimum/maximum bounds by @jimhoyd in #697
• feat(forms): confirmation can show opted-in submitted fields (#527) by @jimhoyd in #700
• fix(core): upgrade checks artifact inertness and reports a failed rollback reinstall by @jimhoyd in #694
• fix(core): name the failing field in invalid extension config errors by @jimhoyd in #695
• Refuse an unexpected Host on a loopback-bound server (DNS-rebinding defence) by @jimhoyd in #699
• feat(auth): per-credential quota on bearer routes (#572) by @jimhoyd in #704
• release: v0.6.1 by @jimhoyd in #706

Full Changelog: v0.6.0...v0.6.1