v0.6.0

What's Changed

• fix: only publish crates on tag pushes by @avrabe in #43
• docs: align README with PulseEngine visual identity by @avrabe in #44
• docs: PulseEngine branding and terminology alignment by @avrabe in #45
• fix: rotate Rekor TLS certificate pin by @avrabe in #51
• feat: add Rivet STPA-Sec traceability and convert security docs by @avrabe in #50
• fix: enforce fail-closed Rekor verification and close STPA-Sec coverage gaps by @avrabe in #52
• feat: add OIDC issuer validation for keyless signing (UCA-12) by @avrabe in #53
• fix: Phase 1 security hardening — sentinel constant, OIDC warnings, skip_rekor by @avrabe in #54
• feat: add ELF and MCUboot signing support with format abstraction (Phase 2) by @avrabe in #55
• feat: add fuzz targets for ELF, MCUboot, and format detection (CV-15) by @avrabe in #56
• feat: add Kani proof harnesses and formal verification strategy (19 proofs) by @avrabe in #57
• feat: transcoding attestation protocol, Nix flake, SLSA L3 artifacts by @avrabe in #58
• feat: build environment attestation for SLSA provenance by @avrabe in #59
• feat: cosign delegation and Rekor proof caching (Phase 3.1 + 4.1) by @avrabe in #60
• feat: Verus formal proofs, PQC module, rules_verus integration by @avrabe in #61
• feat: OCI referrers, Sigstore bundle, Lean4 proofs, CI hardening by @avrabe in #62
• feat: fill Verus/Lean proofs and wire proof cache into verifier by @avrabe in #63
• ci: make Kani bounded model checking a required check by @avrabe in #64
• fix: target Kani proofs to wsc package with bounded unwind by @avrabe in #65
• feat: SCT monitoring, checkpoint consistency, fix rivet validation by @avrabe in #66
• chore: release v0.6.0 by @avrabe in #67
• feat: compliance report in release pipeline by @avrabe in #68

Full Changelog: v0.5.1...v0.6.0