v0.6.0: The CLI stops lying about outages

The CLI stops lying about outages, and the new domains join the 24/7 collector.

One honest error surface across all 53 CLI commands

• 33 commands used to render an upstream {"error": ...} as a healthy empty state - "0 earthquakes" over an empty table during a USGS outage, error text discarded. Every command now routes through one shared bail-on-error path: the upstream error prints prominently in table mode, and --json-output passes the raw dict through unchanged (including intel report, which previously ignored the flag).
• The 17 commands that surfaced errors as raw JSON dumps now use the same human-readable red Error: line as everyone else.
• Partial degradation renders data plus a visible warning: intel climate names its unavailable zones instead of dropping them; a displacement outage prints the error instead of "Grand total: 0".
• 43 tests failed against the old behavior before the fix; the CLI suite is now 144 tests.

Markup injection closed

• Lowercase bracketed values (news categories, sanctions entity types, gh-trending languages) were silently swallowed as Rich markup; a remote feed title containing a malformed tag could crash the command with a MarkupError. Everything remote is now escaped per-site, and table cells render remote data literally via rich.text.Text with column styling preserved - "Coast of [/] Chile" in an earthquake place name renders exactly as written. 11 injection tests cover both the swallow and the crash mode.
• The intel report fallback hint finally prints its [pdf] extra, so the suggested pip command actually installs the pdf extra.

Collector

The four 0.5.0 domains (weather alerts, launch schedule, volcano activity, cyclones) joined the collector's 24/7 vector-store roster: 46 -> 50 sources, with the roster invariant test, domain groups, and category mappings updated together.

Credits

Richard Barron (@RichardBarron27, Red Specter Security Research) for the external security report (#21) that prompted the SECURITY.md threat model and cache-permissions hardening shipped in 0.4.0.

813 non-smoke tests, 90.7% coverage (CI gate at 89), cli.py at 99%. Full detail in CHANGELOG.md.