chore: release 0.6.0

[lloydsk]

Manual release of 0.6.0, seeded because the RELEASE_PLEASE_TOKEN is still pending org-owner approval.

Version: 3 feat since v0.5.0 → minor bump.

Also bumps .release-please-manifest.json to 0.6.0 in the same commit. That is the load-bearing part: the manifest is release-please's record of the last released version, so leaving it at 0.5.0 would make the first automated run propose an already-published version.

CHANGELOG.md is new and written in release-please's own format, so its next run prepends above it rather than producing a duplicate entry.

Note 8cba8d9 Address review findings; bound bggrep matching (#11) is deliberately absent — no Conventional Commit prefix, so it gets no changelog entry.

0.6.0

Features

• digest: opt-in scorecards with type/match selectors, per-project nudge, and diagnostics
• default job logs to the project-local jobs dir
• background job log size ceiling, hardened by an adversarial pass

Bug Fixes

• ci: grant pull-requests: write in release caller for reused ci.yml

After merging

Tag v0.6.0 and create the GitHub Release (which fires release.yml → npm publish over OIDC). Must happen promptly: until the tag exists, release-please cannot bound the commit range and may propose a spurious 0.7.0.

[github-actions]

CI report

Check	Result
tsc --noEmit	success
tests	success
npm pack --dry-run	success (7 files in tarball)

Ref: 2a80724a7a8939c64932250551886c026dd6a72d