release: promote v0.5.6 to main

[mohanagy]

Pull request\n\n## Summary\n\nPromote the reviewed 0.5.6 release from development to main.\n\nRelease contents:\n\n- #326: actionable Console setup completion, account switching, stale-response protection, and successful reauthentication recovery\n- #328: version, lockfile, changelog, README, and focused 0.5 documentation prepared for 0.5.6\n- #329: no-content main ancestry reconciliation\n\nTracks #327.\n\n## Security impact\n\nNo new change is introduced by this promotion PR. The release keeps existing credential handling, routing, policy enforcement, redaction, fail-closed audit behavior, no-shell subprocess execution, dependency resolution, POSIX containment, Windows containment, and public API boundaries unchanged. No dependency version or workflow changed.\n\n## Validation\n\n- [x] A failing 0.5.6 release contract was observed before release metadata was updated.\n- [x] npm run lint\n- [x] npm run typecheck\n- [x] npm test\n- [x] npm run test:core\n- [x] npm run test:coverage\n- [x] npm run build\n- [x] node dist/cli/main.js schema through npm run smoke:cli\n- [x] npm run check:pack\n- [x] npm run test:package\n- [x] Release/docs contracts passed 31/31.\n- [x] Release-prep CI passed on Linux, macOS, and Windows with Node 20/22/24, plus Linux quality and Verify.\n- [x] Ancestry-reconciliation CI passed on the same complete matrix.\n- [x] Independent release and ancestry reviews were clean.\n- [x] Fixtures, logs, screenshots, and examples contain no credentials or private data.\n- [x] User-facing documentation and CHANGELOG.md are updated.\n- [x] Dependency and packaged-file changes are intentional and reviewed.\n- [x] Undisclosed vulnerabilities are reported privately instead of in this pull request.\n\n## Publication boundary\n\nMerging this PR does not itself publish npm. After merge, v0.5.6 must be created as a GitHub Release whose tag points to the exact current main commit. The protected Publish workflow must then perform trusted npm publishing. Issue #327 remains open until registry version, provenance, fresh installation, and release workflow evidence are verified. External validation remains incomplete under #25, #88, #202, and #290.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 8d09e3bf-7cc3-47c8-9f38-b95cd44dc15d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[mohanagy]

Final promotion gate evidence:

• Exact head 06d650e is mergeable and CLEAN against main.
• Both CI matrices are green across Linux, macOS, Windows, Node 20, 22, and 24; Linux quality and Verify are green.
• The isolated macOS Node 24 timeout passed on failed-job rerun without changing timeouts, tests, or source.
• CodeRabbit reports success with review skipped because reviews are disabled for the main base branch; no approval is claimed.
• Independent exact-head promotion review: CLEAN. Scope is exactly PRs Make Console setup and account switching actionable #326, release: prepare v0.5.6 #328, and chore(release): reconcile main ancestry for v0.5.6 #329; current main is an ancestor; no workflow, dependency, or publishing-path changes were introduced.
• External validation remains open in [Product] Validate the local multi-account MCP broker wedge with design partners #25, [Release] Validate Console/OAuth compatibility, recovery, and design-partner evidence #88, [Product] Make trust controls and multi-account onboarding discoverable #202, and [Docs] Redesign README for a first-time Miftah user #290 and is not claimed complete.