Release Repyy 0.6.0 scanner and demo improvements

[Kevin-Umali]

Summary

Complete Repyy 0.6.0's known Phase 2 scope and whole-app review:

• Add sourced package intelligence, bounded literal decoding, supported Axios response-to-execution correlation, and clearer version/coverage semantics.
• Harden TAR expansion, line-count and Git diagnostic limits; preserve nested npm v1 lockfile packages; correct Docker mount encoding and progress sanitization.
• Add a bounded, reviewable advisory ingestion path. Remove the obsolete local corpus replay script and committed research report.
• Refresh the inert demo with 11 risky/control pairs scanned by the 0.6.0 preview code, add a web changelog, and keep pinned real-corpus observations clearly labeled as the older baseline.

Verification

• go test -race ./...
• go vet ./...
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
• go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 ./... — no vulnerabilities found
• python3 -m unittest discover -s scripts -p 'test_*.py'
• cd site && npm run format:check && npm run check && npm run build
• python3 site/check_docs.py
• python3 scripts/benchmark.py --binary /private/tmp/repyy-demo-preview --output /private/tmp/repyy-demo-preview-output --check — 11/11 expected signals, 0/11 high/critical controls, zero incomplete scans

The benchmark uses only inert fixtures. No malicious sample repository code, dependency, lifecycle script, or endpoint was run or contacted.

Limits and follow-up

The public demo artifact is from a local 0.6.0-dev preview build; the release workflow independently publishes benchmark results from the official 0.6.0 binary. The pinned real-corpus baseline has not been rerun for this release in an isolated environment. The /threats page remains deferred because the supplied objective ends mid-Part XIV; docs/THREATS-PAGE-INPUTS.md records the missing inputs. No actor attribution or general detection-completeness claim is made.