v0.5.0

Changelog

• 06031bd ci(release): give npm smoke 10 minutes for registry propagation
• 7575013 docs(changelog): cut 0.5.0 — pgbot why + pgaudit posture findings
• 4710e06 docs(spec): pgbot why — deterministic root-cause chains from baseline history
• a649dd4 feat(store): LoadRange — a fingerprint's snapshots in a window, oldest first
• c679441 feat(why): default 5 chains, positional count — pgbot why 10
• 327de71 feat(why): engine core — onset detection + the flagship seq-scan causal chain
• 5691d7c feat(why): self-describing output — scope, totals, cap announcement, legend
• feb4399 feat: pgaudit posture findings — silent audit, parameter leakage, double logging
• 963c794 feat: pgbot why — the causal-chain command, offline from the baseline store
• e40cd53 fix(docs): pgaudit verify snippets query pg_settings, not SHOW
• 2161eb8 style: gofmt findings.go (knownIDs map alignment)
• 932fc0c style: gofmt why_test.go