Release 2.6.0 step 2: merge v2/main into main and cut the release #2303

Summary

Merge v2/main into main for the v2.6.0 milestone, smoke-test the release candidate from the production build, and cut the GitHub Release that triggers publishing.

Step 1 (#2300, PR #2302) is merged: v2/main reads 2.6.0 and carries the release audit plus the hono advisory fix.

Scope

• A milestone-merge branch cut from origin/main, taking v2/main whole — no commits of its own. The merge commit's tree must be byte-identical to origin/v2/main.
• npm run local:gate in a dedicated worktree with a full npm install.
• A hand-driven smoke of every contribution closed in the milestone, from the production build (the packaged bin and built bundles, not vite dev), through whichever clients each change touches.
• A ledger artifact recording what was driven and what was observed, linked from the PR for maintainer review.
• After merge: tag origin/main with the bare 2.6.0 (no v prefix) and publish the Release.

If the smoke finds something

The fix goes on v2/main, never on the merge branch — an ordinary PR against v2/main, then re-merge into the merge branch so it arrives the way everything else did. That keeps the merge tree identical to origin/v2/main (#2000 → #2092; #2215 → #2216–2224).

Acceptance

• Merge commit tree hash == origin/v2/main tree hash
• npm run local:gate passes on the merge branch
• Every closed milestone issue driven and recorded in the ledger
• Ledger artifact published and linked from the PR
• Release tagged 2.6.0 on origin/main and published