0.1.0-alpha.6

Fixed

• The release pipeline locates the dependency SBOM instead of assuming its
  depth (#109 aftermath). cargo-cyclonedx writes the instrument's SBOM
  beside its crate manifest, except when the workspace member's version
  matches a published crates.io version, when it writes to the workspace
  root — both observed first-hand. The binaries lane searched a fixed depth,
  found nothing at the alpha.5 cut, and both binary legs failed; it now
  searches both locations and excludes the console crate's SBOMs by path.