Release v2.6.0

I want to release v2.6.0 because every change in its changelog section is merged.

It carries:

Added

• a two-part callout, a pattern block and a terminal frame in the docs chrome, with status tints, a text theme toggle and four tokens
• applies_when_grep, a precondition gate keyed on file content

Changed

• docs chrome labels share one mono-capitals tier, and a wide page runs one width top to bottom
• the docs nav underlines the active page, and the rail's active link is semibold
• provenance applies to a project whose pipeline signs, not one carrying a *.lock.toml
• posture-claims takes an optional branch_evidence: per claim
• the posture-claims verifier template splits into a tag job and a branch job

Removed

• the design bundle no longer renders mermaid (!165 (merged))

Fixed

• the pipeline component index says it lists what the catalog carries, not what a project must include
• provenance accepts SLSA, CycloneDX, SBOM, SPDX and in-toto
• docs chrome links break inside a long URL

just sync moves every .reference.yaml pin and template design bundle URL to v2.6.0. I hand-edited the illustrative pin in standards/design/check.sh, which the sync glob skips.

Checks run on the branch head:

• just guard: 0 violations
• just validate with a local catalog checkout: all gates green, and v2.6.0 extracts as tag notes
• just check: 21 standards passed, 0 failed
• just build and just agent: the site builds and the agent surface is complete
• just ship: all gates green

Not tested: the tag pipeline and the design/v2.6.0/ bundle the templates now pin, which publish only once the tag exists.

An AI tool wrote this change and ran the checks above.