v0.6.5

Fix runner-bound core ownership when the pinned release-readiness checkout is located beneath the consumer repository root. The core is authenticated by the runner-provided canonical file URL and enforced package version, regardless of checkout location. Includes a regression test matching the GitHub Actions checkout layout.