chore: bump wails/v3 beta.5 -> beta.6 (Dependabot #2)

[alicoding]

Summary

Supersedes Dependabot #2 (github.com/wailsapp/wails/v3 beta.5 -> beta.6)
via a hand-driven bump per this repo's deps-don't-linger policy, with the
extra scrutiny pass ADR/CLAUDE.md conventions call for on wails bumps.

• go.mod/go.sum: wails/v3 beta.5 -> beta.6 (only transitive mover:
  golang.org/x/net v0.55.0 -> v0.56.0).
• wails3 CLI upgraded to beta.6 for task common:generate:bindings --
  zero binding diff, confirming no bound-method-signature or
  generation-format changes in this release.
• Fixed a pre-existing drift in .github/workflows/release.yml: its
  wails3 CLI install was still pinned at beta.4 (never updated when
  go.mod moved to beta.5) -- now matches go.mod at beta.6.
• frontend/package.json's @wailsio/runtime stays exact-pinned at
  3.0.0-beta.5 -- npm never published a 3.0.0-beta.6 tarball at all
  (registry jumps beta.5 -> beta.7 directly). Verified both of beta.6's
  feature PRs (fix(v3): keep oversized event payloads out of evaluateJavaScript wailsapp/wails#5930 bounded event storage/ordered
  delivery, #5921 dock bounce) touch Go-only files with zero JS/TS
  runtime changes, so there's no protocol-compatibility risk in staying
  on beta.5 client-side.

Changelog findings (the two things this pass was asked to check)

(a) Dock bounce/badge -- beta.6 adds macOS Dock bounce for window
flashing (#5921). Confirmed against the actual PR diff: it extends the
existing WebviewWindow.Flash(enabled bool) to macOS via
[NSApp requestUserAttention:NSInformationalRequest] -- a one-shot,
self-completing bounce, not a persistent badge (disabling is a
no-op since the OS request already completed on its own). Go-only,
no new JS/TS binding. Mill doesn't call Flash anywhere today --
available, unused unlock; not adopted here (a composition-boundary
question for a future goal, not a mechanical dependency bump).

(b) Window/panel APIs (ADR-0033) -- no NSWindow/NSPanel or
activation-policy changes in beta.6. settingsservice_panel.go's
"no non-activating-panel mechanism at beta.4" comment remains accurate
and unchanged -- nothing to unlock, nothing to follow up on.

Test plan

• go vet / go build -- default (desktop) tags and -tags server
• go test . ./internal/... -race -cover -- 40/40 packages green
• golangci-lint run --build-tags=server (CGO_ENABLED=0) -- 0 issues
• task common:generate:bindings -- zero diff
• Frontend: eslint (0 errors, 5 pre-existing warnings),
  depcruise boundaries clean, tsc --noEmit clean,
  vitest run 231/231
• Full local Playwright e2e (58 spec files, 189 tests): 186 passed
  clean, 3 flaky-then-passed-on-retry
  (resizable-table.spec.ts, seed-completeness.spec.ts,
  state-persistence.spec.ts), 0 real failures.
  resizable-table.spec.ts is recurrence build(deps): Bump the npm-dependencies group in /frontend with 3 updates #3 post-hardening --
  reproduced clean on an isolated rerun (--retries=0), consistent
  with the known parallel-worker drag-timing flake, not
  wails-related -- flagged as evidence for reopening its hardening,
  not blocking this bump. canvas-live-sync.spec.ts did not fail
  (no recurrence signal there).

🤖 Generated with Claude Code

https://claude.ai/code/session_018pkViCNAuZp2vBv2K9AbUh