Release 0.6.0: widget assets, MDI, and network permissions

[Misiu]

Summary

• load package-owned assets from widgets//assets and expose bounded data URIs to Liquid
• add generic permissions.network.allowedOrigins with local-only defaults
• pass only origins used by the composed screen to Renderer API v2
• move Weather to local Material Design Icons and synchronize its 0.6.0 package
• keep preview and Media Source on the same composition/render path

Validation

• 83 Python tests
• Ruff and mypy
• 28 frontend tests and production build
• CLI publish and real Chromium renders at 800x480, 190x228, and 520x149
• request-scoped network/cache regression test in Renderer