Prepares the encryptor 0.6.0 release

[johnnyt]

Prepares the encryptor 0.6.0 release: the version bump, the changelog
promotion and the install pins. Refs: enc-33zm.

Held for the operator's merge. This prep is not merged by an agent. Once
it is on main, the merged commit is tagged v0.6.0 (annotated, "encryptor
0.6.0") and the operator runs mix hex.publish.

The version word: 0.6.0

A minor, because the promoted section opens with a bold Breaking heading.
Two fragments chose it:

• changelog.d/enc-asn.md (Breaking): a vault refuses to start on an option it
  does not read, as {:invalid_config, layer, {:unknown_options, keys}}.
• changelog.d/enc-hpx.md (Breaking): Encryptor.Provider.GcpKms answers a
  Decrypt refused with HTTP 400 or 404 as
  {:invalid_key_descriptor, {:kms_refused, status}}.

The other two fragments, changelog.d/enc-jwkn.md and changelog.d/enc-ris3.md,
are Fixed and would alone have made a patch.

What changed

• mix.exs: @version 0.5.0 -> 0.6.0.
• CHANGELOG.md: a ## [0.6.0] section dated today, ### **Breaking** first
  (enc-asn, then enc-hpx) and ### Fixed (enc-jwkn, then enc-ris3), every bullet carried over
  verbatim; the header's changelog.d/ link moves from the v0.5.0 tag to
  v0.6.0, the tag this release will carry. Nothing above or below the new
  section moves.
• changelog.d/enc-asn.md, enc-hpx.md, enc-jwkn.md, enc-ris3.md: deleted in the same
  commit, per the changelog.d README's "At release". changelog.d/README.md
  stays.
• README.md and guides/getting-started.md: the install pin
  {:encryptor, "~> 0.6.0"}, and the guide's sentence naming the patch range
  that pin admits.

The branch is rebuilt on main after the enc-jwkn fix and the mint lock
update landed: the promotion was re-run over the four fragments rather than
merged by hand. The file set follows the 0.5.0 prep (9ad74e2), plus the CHANGELOG header link,
which has pointed at the latest release tag since 2f2bd45.

Closed vocabularies since 0.5.0

Read over every promoted fragment and git diff v0.5.0..origin/main -- lib:

• {:unknown_options, keys}, a new detail under {:invalid_config, layer, _}
  (Encryptor.Vault.Config, known_options/3). The family is unchanged, so
  Encryptor.Telemetry.reason_tag/1 still tags it :invalid_config.
• {:kms_refused, status}, a new detail under {:invalid_key_descriptor, _}
  (Encryptor.Provider.GcpKms, decrypt_failure/2); reason_tag/1 tags it
  :invalid_key_descriptor.
• {:timeout, milliseconds} in the :engine field of
  {:suspension_store_unavailable, store} when a shared store's call passes
  its bound (Encryptor.Vault.Suspension, call_store/4), documented in the
  Encryptor.Vault.Suspension.Store moduledoc. The reason itself is unchanged.

No new top-level reason, telemetry event or vault option was added; the
option set a vault accepts is now closed (the enc-asn line above). The
enc-jwkn fix adds no public surface: Encryptor.Vault.Partition.id/2 is
unchanged, the new write-side encryption_id/3 is @doc false, and the
other modules it touches, Encryptor.Vault.Encrypt and Encryptor.Vault.Rekey,
are @moduledoc false.

Gate

Full mix quality on the committed tree, quoted whole:

✓ Format: No changes needed (283ms)
✓ Compile: dev + test compiled (warnings as errors) (1.6s)

Running analysis stages in parallel...

○ Doctor: skipped (:doctor not installed)
○ Gettext: skipped (:gettext not installed)
○ Sobelow: skipped (:sobelow not installed)
✓ Doc links: 15 links checked (10ms)
✓ Dependencies: No unused dependencies (496ms)
✓ Credo: No issues (1.1s)
✓ Docs: No warnings (1.2s)
✓ Dialyzer: No warnings (5.3s)
✓ Tests: 684 of 684 passed, 97.3% coverage (9.7s)

✓ All quality checks passed!

The commit's tree is byte-identical to the tree that run passed on.

Checked

Each acceptance line against the branch: changelog.d/ held four fragments
at the base, all four promoted and deleted; mix.exs reads 0.6.0; the README
and guide pins read ~> 0.6.0 and no ~> 0.5.0 pin remains outside the
changelog and the accepted records' history lines; the version word and the
fragments that chose it are above. The tag and the publish are not in this
change.