Record verified npm 0.6.0 publication

[lifrary]

Summary

• Record 0.6.0 as the published npm release and update the post-publish smoke version/schema.
• Clarify separate login and publish approvals, supervised TTY requirements, verified-tarball publishing from a separate build host, and npm's processing delay.
• Remove the incorrect requirement to create a 2FA-bypass token; do not disable authentication or validation gates.

Verified distribution

• Registry version and latest tag both resolve to 0.6.0.
• Registry SHA256, SHA1 and SHA512 integrity match the previously checked GitHub/server artifact.
• Fresh registry installation on the server passed both-source CLI exports, CLI/MCP catalog totals, MCP version and seven-tool schemas, child-search parent linkage, and cache refresh after a child-only append.
• Product source and committed bundles are unchanged.