chore(release): prepare @hasna/contracts 0.10.6

[andrei-hasna]

Summary

• bump @hasna/contracts from registry-current 0.10.5 to 0.10.6
• ship the already-merged safe-read work from feat(safe-read): prove a collection read complete, or refuse #100 and fix(safe-read): follow numeric cursors #101
• ship the already-merged metadata-only verify-write command from Add metadata-only verify-write command #102
• document the patch release and update all package-version pins

Verification

• targeted TDD red arm: Expected: "0.10.5" / Received: "0.10.6"
• targeted green arm: 15 pass, 0 fail
• full tests: 1419 pass, 7 skip, 0 fail
• separate typecheck: exit 0
• verify:release: final artifact line pass artifact-scan hasna-contracts-0.10.6.tgz (packed_artifact, 231 members scanned, 0 excluded, 0 unreadable)
• staged secret scan: exit 0, 5 files, 361389 bytes scanned, 0 findings

Coordination

• Native goal plan: 92ddccf1-dd45-4576-9a89-0237ae10e462
• Todos plan: e0f3f715-dda5-4263-8f61-8792d75589b1
• Release task: 63fa16ee-09d0-486e-9733-aa8f84d64e3f
• Review task: b6da56f7-2de9-430d-b5f4-2af7ee7436e5

The single independent release review will run against the exact landed main commit before npm publishing begins.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #103 @ ed8d966 — lens: correctness+security+gates, reviewer Hostus (1 of 1)

Reviewed the exact candidate against freshly fetched origin/main at 33813f3. I read the full diff for CHANGELOG.md, hasna.contract.json, package.json, src/schemas.ts, and tests/published-package-security.test.ts, plus the surrounding release scripts, version-coupling tests, package exports, and the three commits on main since the published 0.10.5 line.

Commands and exact results:

• bun install — exit 0. Setup only; 23 packages installed, not counted as a test gate.
• bun run typecheck — exit 0. tsc --noEmit produced 0 diagnostics; this gate emits no pass/fail test count.
• bun run test — exit 0. 1419 pass, 0 fail, 7 skip; 1426 tests across 62 files, 14028 expect() calls.

Blocking P0/P1 findings: none. The PR changes only the four coupled 0.10.6 version/release markers and the matching changelog. The packed-package version checks, generated-output consistency checks, artifact/security coverage, and the declared typecheck/test gates all pass.

Non-blocking follow-ups: none.

Disposition note: immediately before this comment, GitHub reported the PR state as MERGED at the reviewed head, so this lane could not perform a pre-merge action.