Cut the v0.6.0 release

[ESultanik]

Summary

Cut the v0.6.0 release once every other issue in the milestone has merged. This is the last item in
the milestone and it is blocked by all of them.

There are 161 commits since the v0.5.6 tag, and pyproject.toml:12 still reads
version = "0.5.6".

Scope

1. Bump the version. pyproject.toml:12 is the whole change. polyfile/polyfile.py:19 reads
   __version__ from package metadata through importlib.metadata.version("polyfile"), so nothing
   else carries a hard-coded version string.

2. Write polyfile_0.6.0.md. Follow the structure of polyfile_0.5.6.md: Performance
   Improvements, Bug Fixes, New Features, Magic Definitions, Breaking Changes, Dependencies. Omit a
   section that has nothing in it.

   The release covers two bodies of work. Summarize rather than list every issue:

   • libmagic fidelity. The definitions moved to 5.48, and all 88 stems of the upstream corpus
     now match what file reports. tests/test_magic.py::KNOWN_FAILURES is empty. Tracking: the 14 stems skipped in test_file_corpus, and the ten causes behind them #3480 records how
     the previous fourteen failures were retired.
   • Packaging. setup.py was replaced by pyproject.toml and the in-tree PEP 517 backend
     build_backend.py (Replace setup.py with pyproject.toml and an in-tree PEP 517 backend #3513).

   Call out under Breaking Changes anything in this milestone that changes observable output. At
   minimum: An untyped indirect offset defaults to big endian, where libmagic uses host byte order #3499 changes how an untyped indirect offset reads its field, A BOM-prefixed JSON document is reported as JSON, where file reports Unicode text #3500 changes what a
   BOM-prefixed JSON document reports, --format file is rejected, json is duplicated in the choices, and the help example uses the wrong flag #3497 changes the accepted values of --format, and try_all_offsets is accepted and ignored, and the CLI flag for it is commented out #3465
   removes the try_all_offsets parameter from Matcher and Analyzer.

3. Verify the distribution. uv build, then uvx twine check dist/*. The distributions job in
   .github/workflows/tests.yml already asserts that the wheel is built from the sdist, that no
   non-permissive .ksy reached the sdist, and that the package-data counts match git ls-files;
   confirm it is green rather than re-deriving it.

Note

Publishing is out of scope for the pull request. .github/workflows/pythonpublish.yml runs on
release: published and uploads through PyPI Trusted Publishing, so the actual release is cut from
the GitHub UI after this merges.