chore: bump version to 0.6.1 (reconcile manifest with release tags)

[bdelanghe]

package.json + package-lock.json were left at 0.5.1 while v0.6.0 and v0.6.1 were tagged — so the published manifest lagged the release tags by two minors. This reconciles the manifest to the latest tag (0.6.1).

Three version strings updated, nothing else: package.json version, and package-lock.json root + packages[""].version.

Note: main is already ahead of the v0.6.1 tag (it has #40/#41, the scan verb). If you consider that a new minor, the next release would bump to 0.7.0 — this PR only stops the manifest from being behind the tags.

PR checklist

1. Independent PR — version reconcile only
2. Changed codepaths verified — no code paths changed; manifest-only, grep confirms no stray 0.5.1 remains
3. Root cause — release tags cut without bumping the manifest
4. No duplication — N/A
5. No unrelated changes — only the three version fields