docs: backfill the 0.6.x changelog and check in a corrected CLAUDE.md

[stormer78]

Prep for publishing 0.6.2. Docs only — no source changes.

CHANGELOG stopped at 0.5.0

Three releases shipped without an entry. Anyone reading the changelog to find out whether the R1.6 ack-ordering fix is in a given version would conclude it doesn't exist. Backfilled from the commits:

0.6.0	TSP frame multiplexing over the mediator socket (onTspFrame)
0.6.1	REST auth realigned to the current VTA wire contract — the legacy atm/1.0/* types meant auth could not succeed at all
0.6.2	hand inbound messages to the consumer before acking the mediator (R1.6)

The 0.6.2 entry carries the consumer-visible contract change: onMessage may now return a promise the transport awaits, and delivery is at-least-once, so handlers must tolerate a duplicate across a reconnect.

CLAUDE.md was untracked, and stale

It existed only in one working copy — and both defects it named as live had since been fixed:

• R3.6 "REST auth ... cannot succeed at all" → fixed in 0.6.1
• R1.6 "_dispatchFrame currently acks before handing off" → fixed in 0.6.2

A doc pointing at already-fixed bugs sends the next person hunting for them, and implies the remaining risks are covered. Each is restated as the invariant not to regress rather than deleted — the R1.6 ordering in particular is a two-line change to undo and fails silently when wrong.

It also now records that mediator auth legitimately keeps its own atm/1.0 message type (different service), so nobody "fixes" that as drift.

New: a Releasing section

The gap that actually bit this week: a fix merged here changes nothing for consumers until it is published. 0.6.2 fixed R1.6 in git on 16 Jul while pnm-browser-plugin kept resolving to 0.6.0 from npm — the newest published version. I initially reported R1.6 as an open cross-repo defect on that basis, and even opened a redundant PR (#8, closed) before spotting #6.

So it records: check npm view @openvtc/vti-didcomm-js version against package.json before assuming a consumer has a fix; the tarball ships src/ directly with no build output; prepack generates the types; and npm pack --dry-run confirms what's really in it.

Verification

• npm test on this branch: 196 pass, 0 fail, 11 skipped (207 total) — unchanged from main, as expected for a docs-only change
• npm pack --dry-run includes src/mediator-transport.js, and the shipping source has await this._deliver(result) before _ackReceived — the 0.6.2 fix is genuinely in the tarball

Note on the working tree

Your local clone was behind (main at 0.6.0's merge) with a stale uncommitted package-lock.json version sync that origin/main had already superseded. I discarded that and pulled; the repo is now clean at de14ca7 / 0.6.2 and ready to publish once this merges.