release: prepare Java Encoder 1.6.0

[jmanico]

Change

Prepare Java Encoder 1.6.0 from merged #247, which resolves #243 by reducing interior JavaScript letter escaping while retaining fragment protection. Set all library/fixture versions, SCM tag and reviewed timestamp; update release notes, migration guidance and dependency/verification examples. Publication remains explicitly pending, and 1.5.1 remains the verified supported release until exact 1.6.0 artifacts are published and compared.

Compatibility and validation

This minor release changes encoded bytes and streaming lookahead/flush spelling. JavaScript values, public APIs, Java 8 support, dependencies and module/bundle identities remain unchanged. Keep the API comparison baseline at published 1.5.1. No runtime implementation change in this preparation PR.

Exact source: d9b0fd62497fb9276429a9ea972f4449ab320f2d.
Reference toolchain: Temurin 17.0.20.1+1, Maven3.10.0, macOS arm64, UTC settings; recorded output timestamp 2026-10-18T17:27:13Z.

Focused model-assisted Sol review recommends MERGE for preparation. Release-baseline/version/whitespace checks pass. Fresh-cache release acceptance, Docker/browser/WAR tests, packaged consumers and two-build reproducibility comparison passed. All required final CI gates passed, including Java 8/11/17/21/25 consumers and Java/Actions/Python CodeQL. The signed clean build passed; all thirteen payload signatures and both checksum-manifest signatures verify. Signed payload bytes match both independent builds. Signing, staging and publication remain separate gates. The empty backlog was inventoried after #247 merged and #243 closed; repeat before publication.

• Scoped preparation; existing notices and historical releases preserved.
• Documentation and changelog distinguish prepared from published artifacts.
• No credentials or private vulnerability evidence included.

Retained Central bundle SHA-256: 8d860714634ae3b53f19bb3ea326f639b74df96c0e82bc956d53f237b5804c16.

Central publication remains pending. The currently signed-in Portal account has no namespace; correct publisher-account access is being restored before upload.