release: prepare v0.5.6

[mohanagy]

Pull request\n\n## Summary\n\nPrepare the compatible 0.5.6 patch release for the Console actionability fixes merged in #325/#326.\n\n- bump package and lockfile metadata to 0.5.6\n- add the dated 0.5.6 changelog entry for #325 and release tracking #327\n- update the README and focused 0.5 documentation to install 0.5.6\n- retain explicit pre-1.0 and incomplete external-validation language\n\nTracks #327.\n\n## Security impact\n\nNo runtime security boundary changes are introduced by this release-only diff. Credential handling, routing, policy enforcement, redaction, audit data, subprocess behavior, dependency resolution, fail-closed behavior, POSIX containment, and Windows containment are unchanged. No dependency or source file changed. Package and documentation versions move together, and the changelog explicitly preserves the existing security guarantees and incomplete external-validation status.\n\n## TDD\n\nThe release-version contract was updated first and failed because package metadata remained 0.5.5 and the 0.5.6 changelog section was missing. It passes after the release-only changes.\n\n## Validation\n\n- [x] A failing test was observed first for each behavior or configuration-contract change.\n- [x] npm run lint\n- [x] npm run typecheck\n- [x] npm test: 142 files passed, 1 platform file skipped; 1,819 tests passed, 33 skipped.\n- [x] npm run test:core: 22 files passed, 1 platform file skipped; 426 tests passed, 26 skipped.\n- [x] npm run test:coverage: passed with thresholds intact.\n- [x] npm run build\n- [x] node dist/cli/main.js schema through npm run smoke:cli\n- [x] npm run check:pack: 48 packaged files verified.\n- [x] npm run test:package: 26 tests passed against the real packed artifact.\n- [x] Focused release and documentation contracts: 31 tests passed.\n- [x] Fixtures, logs, screenshots, and examples contain no credentials or private data.\n- [x] User-facing documentation and CHANGELOG.md are updated.\n- [x] Dependency and packaged-file changes are intentional and reviewed: no dependency versions or package allowlist changed; only the package release version changed.\n- [x] Undisclosed vulnerabilities are reported privately instead of in this pull request.\n\nThe initial aggregate test and coverage attempts encountered unchanged lifecycle test timeouts while the host load average exceeded 11. The affected tests passed unchanged in isolation, and the exact full commands passed after load settled. No timeout, coverage, platform, containment, or test configuration was changed.\n\n## Release boundary\n\nNo workstation publication is part of this PR. After merge to development, release promotion remains a separate development-to-main PR followed by an exact-main GitHub Release and protected trusted publishing.

[coderabbitai]

📝 Walkthrough

Walkthrough

This patch prepares release v0.5.6. It updates package metadata, installation documentation, and the changelog. Release tests now validate the new version, release artifacts, and changelog entries.

Changes

Release preparation

Layer / File(s)	Summary
Release metadata and documentation package.json, CHANGELOG.md, README.md, docs/...	The package version, installation commands, documented version, and v0.5.6 changelog entry were updated.
Release validation tests/release-version.test.ts	Release tests now validate version 0.5.6, malformed changelog headings, issue links, and the new fixed-item content.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• mohanagy/miftah issue 327 — Defines the v0.5.6 release scope covered by the version, changelog, documentation, and validation updates.

Possibly related PRs

• mohanagy/miftah#298 — Prepares another patch release with the same package, documentation, changelog, and release-test pattern.
• mohanagy/miftah#306 — Updates successive release metadata and release-contract assertions.
• mohanagy/miftah#162 — Strengthens tests/release-version.test.ts release validation.

Poem

A rabbit checks the version line,
“0.5.6” now looks fine.
The changelog hops into place,
Docs and tests keep steady pace.
Release carrots, neatly stacked—
v0.5.6 is packed! 🐇

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Docstring Coverage	❌ Error	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely identifies the primary change: preparing release v0.5.6.
Description check	✅ Passed	The description covers the required summary, security impact, validation results, documentation updates, and release boundaries.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/0.5.6

---

_{Comment @coderabbitai help to get the list of available commands.}

[mohanagy]

Final exact-head release-prep evidence for e9617b2:\n\n- TDD: the 0.5.6 release contract failed first on 0.5.5 metadata and a missing 0.5.6 changelog section, then passed after the release-only changes.\n- Local gates passed: npm test, test:core, test:coverage, lint, typecheck, build, smoke:cli, check:pack, and test:package.\n- Focused release/docs contracts passed 31/31.\n- Current-head CI passed on Linux, macOS, and Windows with Node 20/22/24, plus Linux quality and Verify.\n- Independent exact-head review: CLEAN; no material findings and no production-source or workflow changes.\n- CodeRabbit produced no inline code findings. Its PR-template warning was corrected by adding the security-impact section and complete validation checklist. Its 0% docstring result is inapplicable to this release-only diff: no production functions were added or changed, and adding docstrings to test-local helpers would not improve the public or runtime contract.\n\nIssue #327 intentionally remains open through promotion, GitHub Release creation, trusted npm publication, and registry/provenance verification.