Harden v0.6.0 release gates and first-run surfaces

[Fieldnote-Echo]

Summary

• wait up to 30 minutes for the latest exact-SHA main push runs across the six release-gated workflows
• fail immediately on terminal non-success or a moving main, including a final post-query head check
• block draft-release creation and every artifact-build front door directly behind the CI gate
• audit the complete locked workspace graph on PRs and the weekly advisory scan
• update anyhow 1.0.102 to 1.0.103 for RUSTSEC-2026-0190 and declare the actual transitive Zlib license
• pin every internal path dependency to the lockstep 0.6.0 requirement and enforce future version-sync updates
• align current README, compatibility, provenance, manifest-schema, and threat-model copy with v0.6.0
• replace degenerate first examples with deterministic checked Rust and Python quickstarts, persistence/reopen, and visible output
• add end-to-end first runs for both manifest packages plus complete ordvec-manifest CLI help
• pin package-specific Python documentation and changelog links and add release invariants for first-run surface drift

Closes #272.

Stack

This is stacked on #298, which is stacked on #297. Merge in that order, then retarget this PR to main. Preserve the signed ancestry with merge commits; squash or rebase merging an earlier PR requires restacking and re-signing downstream commits.

Validation

• release publish invariants: 18 tests pass
• signed-release invariants: pass
• actionlint v1.7.12: pass
• cargo-deny full locked workspace/all-features: pass
• cargo audit: no vulnerability after the documented dev-only bincode ignore
• ordvec all-features: 352 pass, 4 ignored
• ordvec-manifest all-features: 122 pass; docs.rs quickstart doctest passes
• ordvec-ffi: 12 pass after CI-equivalent build
• locally built v0.6.0 wheels: ordvec Python 505 pass; ordvec-manifest Python 7 pass
• Rust and Python first runs: exact top document 0, score 0.396; persistence and two-stage follow-on pass
• CLI create/verify first run: exact manifest path followed by verified
• all-workspace all-target/all-feature clippy: clean
• independent launch red-team: SHIP after narrowing current-contract invariants so historical migration text remains allowed

The full cargo test workspace command is not a valid local aggregate for the PyO3 cdylib members because it tries to link binding test harnesses without libpython; the package-separated Rust lanes plus wheel-installed Python suites above pass.

External pre-tag blocker

The repository now reports the live environment drift honestly. Do not tag v0.6.0 until tests/release_environment_settings.sh passes for both crates-io and pypi: restore toadkicker as an eligible reviewer, enable prevent self-review, and restore the 30-minute wait timer. The release-tag patterns are already correct.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!