organic-os v0.6.1 - community wave two, hardened under review

Three community PRs from @waterlemonnn, each adversarially reviewed and mutation-tested before merge:

• registry.unregister() (#24, closes #1) - /organic-os:reset used to instruct a hand edit of sites.yaml, re-implementing the atomic-write + chmod pattern in prose. It now calls the one writer lib/core is supposed to be: unknown-slug guard before any write, active pointer cleared when the removed site held it.
• Printable-ASCII token guard (#23, closes #20) - a zero-width space, BOM, or accented letter in a mispasted Telegram token now fails fast at the sanitizer with the reason named, instead of deeper in the HTTP stack. The error message is a constant; the token can never appear in it.
• All three CI checks documented (#22, closes #4) - verify-gates.sh ran in CI but was missing from CONTRIBUTING's pre-PR steps, so a contributor following the docs exactly could be green locally and still fail CI.

The review process earned its keep twice this release. Mutation testing showed #24's permissions test passed without exercising the code it claimed to test (a plain write survived, because the file was already 600 from an earlier call); the test is now discriminating, verified failing against the mutant and passing against the real code. And the same review surfaced a pre-existing defect nobody had reported: the registry's atomic write left its tmp file at default-umask permissions before the final chmod, so site names and brain paths briefly sat world-readable. The tmp file is now 0600 for its whole life, stale-tmp-after-crash case included.

477 tests, 9 audit checks, 8 gate probes, CI green.