chore: prepare verified 0.6.0 CLI and plugin release

[ASRagab]

Summary

optimize-anything 0.6.0 has a version-aligned CLI and shared Claude Code/Codex plugin path that runs from a clean install on the tested macOS host. The release also brings active guides and packaged skills into line with the current CLI, and records a bounded live Codex optimization with an explicit rejection decision.

This packages the subscription-backend work already merged to main. The existing single skills tree and host manifests remain the distribution format.

What changed for users

• The bundled plugin launcher selects the pinned Codex SDK before Python starts; a global CLI install can opt in with install.sh --codex. The default installer also works under macOS Bash 3.2.
• All four shared skills resolve the bundled runtime. Dataset generation and the LiteLLM evaluator example now use runnable commands in the plugin environment.
• Active examples, the smoke guide, install guidance, release notes, and Python/Claude/Codex version fields reflect 0.6.0. .cursor/ is ignored, and no Cursor files are included.

Evidence and checks

• Full gate on PR head 12b3a45: uv run python scripts/check.py passed (546 tests passed, 18 skipped), CLI smoke passed, and all three score baselines passed. The credentialed plugin regression was skipped because --with-plugin was not set.
• uv run mypy src/optimize_anything found no issues in 27 source files; Bash syntax checks passed. The 0.6.0 wheel and source distribution built successfully.
• An isolated U2 plugin snapshot without a global CLI discovered four skills and nine Claude commands. Its launcher resolved Codex SDK 0.156.0, ran budget, generated a Codex/no-fallback evaluator, and passed child preflight. The review repair also ran the LiteLLM template's preflight through the locked plugin environment without a provider call.
• Two live Codex subscription runs scored six distinct proposals in 14 evaluator calls. The frozen skill scored 0.8876; the best proposal scored 0.8728, so none was accepted. No API fallback occurred and scores.json stayed unchanged. A later CLI-example correction scores 0.8875. The summary's num_candidates=1 counts retained candidates, while the run logs show the six evaluated proposals; the release evidence records that failed plan proxy explicitly.
• Sample bundled CLI output from scripts/run-optimize-anything budget examples/seeds/sample_seed.txt:

  {"recommended_budget": 50, "rationale": "Short artifact", "seed_length": 79}

The tracked gate and provenance record is docs/verification/release-0.6.0.md. The Compound Engineering review completed (status: complete, run 20260927-174849-e5d41434, local artifact /tmp/compound-engineering-501/ce-code-review/20260927-174849-e5d41434). Three validated findings were fixed before this PR; the independent Claude adversarial pass is included in that receipt.

Unapplied review findings

• P2 — scripts/run-optimize-anything:16 — The forced Codex extra prevents API-only plugin commands on architectures without an openai-codex-cli-bin wheel. Suggested fix: decide the plugin's platform support boundary, then select a route that preserves API-only use where the Codex binary is unavailable. The 0.6.0 install check covers macOS arm64; install.md documents the current limit and the global CLI/source API-only path. Review run: 20260927-174849-e5d41434.

The separate GEPA cache-route and TOML representation findings remain follow-ups with operating guidance in the release evidence.

Post-Deploy Monitoring & Validation

Owner: release maintainer. Validation window: after merge and before tagging, then immediately after publishing.

• Inspect the main workflow for the merge SHA. The unit/smoke/score job must pass. Record each provider integration case as executed pass, executed failure, or credential skip; a skipped case is partial evidence and an executed failure stops publication.
• Build and install from v0.6.0 at that exact merge SHA, with OPTIMIZE_ANYTHING_REF=v0.6.0 for the CLI installer. A successful install, optimize-anything --help, and bundled plugin budget invocation are the expected signals.
• If a required job fails or the tagged install cannot run, stop publication and fix through a new PR and merge SHA. After publication, verify the tag and GitHub Release target the recorded SHA. There is no production service telemetry for this CLI/plugin release.

---