1.0.5-rc.6

1.0.5-rc.6 — release candidate on all four registries

Coordinates (the tree at this SHA reads 1.0.4 / 8.0.4 — a pre-release version is
never committed, so this annotation is the only record):

npm 1.0.5-rc.6 14 packages, dist-tag next
PyPI 1.0.5rc6
NuGet 1.0.5-rc.6 4 packages
Maven Central 8.0.5-rc.6

All four moved: every port changed product code since its last candidate (npm
since rc.4, NuGet since rc.5, PyPI and Maven since rc.3).

metamodelVersion stays 1.0.

Cut so the adopter estate can observe, on PUBLISHED artifacts, fixes it could
only read about until now:

• F16 a database constraint violation answers the cross-port 409 envelope
  instead of a bare 500 (Java, Kotlin, Python).
• F20 the filter/sort 400 envelope names the rejected field, in all five
  ports, and the corpus now asserts it.
• F21 the Maven plugin validates against layer tokens, so
  "iam/db" is accepted.
• F22 a view-only projection gets a read-only REST surface in all five ports:
  reads served, every write verb answering 405 {"error":
  "method_not_allowed"}.
• F25 a generated Spring POST no longer validates the server-generated
  primary key out of the caller's body, so a create can succeed.

Also in this candidate: the GET /_meta metadata API contract (FR-029) with the
browser read-model in runtime-web; PUT on a writable entity now reaches the
update handler on runtime-ts's Hono and ObjectManager-Fastify mounts, and is
documented by the TS, Java and Kotlin api-docs builders.

Not in this candidate: the unmerged Kotlin requireNotNull fix (#388), owned by
a live session.

Verified on this SHA: local-ci run 35678598367 green on all eight lanes
(ts-unit, ts-fast, ts-slow, gates, python, csharp, java-fast, java-slow);
scripts/ci-local.sh --quick 36/36.