v0.6.2

• Removes the unused world-only mar.run path, RunOptions, world checks,
  the Random wrapper, and redundant SimCase forwarding helpers. Simulation
  cases now pass World.SimulateOptions directly instead of relying on a
  reflective field copier.

• Collapses Tracer and its wrapper into one Recorder capability. A recorder
  is either world-backed or disabled; production options now accept an optional
  recorder directly.

• Names and versions Marionette's simulated disk semantics as portable_v1
  (version 1). Every simulated disk trace now records the sector size,
  sector-prefix tear model, crash-global reversal model, and lifecycle
  commit policy in a disk.model event. The public contract constants and
  disk fault-model documentation distinguish this portable adversarial model
  from any OS- or filesystem-specific promise. The trace header advances to
  format version 2 for the mandatory event-vocabulary change.

• Makes disk crash application transactional across allocation, tracing, and
  process notification. Only affected files, directories, and pending metadata
  are staged off to the side, avoiding a deep copy of unrelated durable media;
  seeded fault choices, per-operation classifications, the crash summary, and
  process-kill records roll back together on failure. Only after all fallible
  work succeeds does the disk atomically publish recovered media, enter the
  crashed state, invalidate process-local I/O, and run lifecycle kill callbacks.
  Newest-to-oldest metadata reconciliation gives later surviving creates and
  renames precedence over older rollbacks, rejects cross-kind path collisions,
  and causally preserves ancestor directories required by surviving or already
  durable descendants. Recovery therefore retains a unique, reachable namespace
  under mixed metadata outcomes.

• Makes std.Io.File.setLength extension one disk lifecycle operation instead
  of a sequence of fallible zero-sector writes. A failed extension can no
  longer leave disk-visible zero writes beyond the still-cached old length;
  successful extension remains zero-filled by the disk authority. Resizes with
  no pending writes allocate no media, while pending-write commits stage only
  the affected file.

• Adds contract, trace-failure, staged-allocation, tiny crash-boundary,
  metamorphic-sync, and all-profile durable-truth regressions. These make the
  existing whole-sector tear, globally classified reversal, and
  existing-media-only scripted corruption rules release-blocking rather than
  scenario-only expectations.