Prepare 0.6.6 release

[skvark]

Release scope

Prepare the root githits 0.6.6 release across npm, Open Plugin, Claude, Gemini, and the official MCP registry manifest.

@githits/mcp remains at 0.6.3 because no published MCP package API, tool behavior, instruction, schema, or remote-server-facing type changed.

User-visible changes since 0.6.5

• Carry GitHits CLI attribution through the OAuth authorization flow so CLI-originated signups and logins can be measured correctly (feat: carry CLI attribution through OAuth callbacks #234).
• Refresh compatible runtime and development dependencies (chore(deps-dev): bump @biomejs/biome from 2.5.2 to 2.5.5 #235, chore(deps): bump smol-toml from 1.6.1 to 1.7.1 #236, chore(deps-dev): bump lint-staged from 17.0.8 to 17.2.0 #237, chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 #238).

The keyring change in #240 is preparatory only and is excluded from the generated release notes. This release still uses @napi-rs/keyring@1.3.0; the upstream release and dependency bump remain tracked in #241.

Validation

• bun test — 2508 passed
• bun run typecheck
• bun run lint — no errors; one pre-existing warning and one schema-version informational diagnostic
• bun run build
• bun run validate:packages
• source CLI smoke — 70 steps passed
• source MCP smoke — 38 steps passed
• built CLI unauthenticated smoke passed
• built MCP registration smoke passed
• mcp-publisher 1.7.9 checksum verification and server.json registry validation passed
• MCP registry domain proof returned 200
• OAuth protected-resource metadata returned 200
• unauthenticated remote MCP initialization returned 401 with the expected resource_metadata challenge

Merging this PR triggers the root release workflow after the successful Main workflow on main. That workflow publishes githits@0.6.6, the v0.6.6 GitHub release, and com.githits/githits@0.6.6 in the MCP registry.