Harden @workit/core 0.6.1 for the 1.0 contract

[AdmilsonCossa]

Summary

• prepare @workit/core 0.6.1 as the final pre-1.0 hardening patch with no runtime features or new exports
• freeze all 16 public entrypoints and retain ContextBagImpl and Node >=20.11 in the 1.0 compatibility contract
• add full declaration snapshots, installed-package compatibility with 0.6.0, and byte-reproducible tarball verification
• make benchmarks/public-proof.json the single source of truth for the 1B throughput and stream-memory gates
• correct stale release/test/history documentation and explicitly document 1.0 omissions (select, unbounded channels, worker pooling, edge, durable in-flight resume)
• add a nightly 1,000-run-per-property profile with rotating reproducible seeds while preserving bounded PR feedback
• update development tooling to zero known audit findings
• record the packed 0.6.1 real Oryn provider/daemon canary as release-blocking evidence

Verification

• npm run verify
• npm run test:coverage: 410/410 tests; 100% statements, branches, functions, and lines
• Node 20.11.1, 22, and 24 compatibility jobs
• Bun 1.3.13 and Deno 2.2.7 installed-package fixtures
• npm production audit: 0 findings; CycloneDX SBOM validated
• 0.6.0 compatibility: 16 package paths and 31 declaration files
• 61 ledger claims: 59 proven, 2 product decisions, 0 blockers
• 9,000-case deep property run completed locally; scheduled profile rotates its seed per workflow run
• real Oryn provider fallback and daemon durable-replay canary against the final tarball
• reproducible tarball SHA-256: 3e0b385a8342df95fb638788d1bc333d4e1efc8b85e7a71839d6e0c0ee84a699
• CodeQL, use-cases site build, full package verification, coverage, and all runtime-matrix checks passed on the final SHA

Release boundary

This PR does not tag or publish 0.6.1. Post-1.0 innovations and real third-party comparative benchmarks remain separate work; local behavioral baselines are explicitly not presented as named-package performance results.