packaging: pin the Umbrel and StartOS packages to satd 0.6.0

[bkeroack]

Moves the Umbrel and StartOS packages to the 0.6.0 release image. This is step 5 of the release checklist, and it comes before syncing the stores. It targets master directly and doesn't depend on #901: release/0.6 is out of the loop for new work.

Changes

• Image: both packages move from master's sha-5e73b1d to ghcr.io/epochbtc/satd:0.6.0@sha256:4d963e3cdfd094be26f306d85c6da68f193864ca1f91f0dd31e2df1825bed3d2. That is the OCI index (linux/amd64 and linux/arm64) the v0.6.0 tag's release run built and cosign-signed.
• Umbrel: version: "0.6.0", new releaseNotes, and the icon URL at v0.6.0.
• StartOS: 0.6.0:0, with the same notes.
• SATD_STACK_SUBNET removed from both packages, and StartOS's bridgeSubnet with it. 0.6.0's satd-init writes rpcallowip=0.0.0.0/0 and reads no subnet (stack, appliance: admit LAN clients to the TLS JSON-RPC listener #887). The variable only mattered while the packages pinned older images. The comments and the StartOS README say so.

The release notes cover what a 0.5.2 install sees on update:

• the app now opens onto the status page (0.5.2 opened onto /api/blocks/tip/height);
• the first start rebuilds the chainstate once, from the block files on disk;
• there's no going back to 0.5.2 without another rebuild.

Both link the full 0.6.0 notes.

Checked (rebased on master)

• contrib/stack/tests/compose-test.sh: all checks pass. Both packages pin 0.6.0, at schema 7 with the status page.
• contrib/packaging/tests/sync-store-test.sh: all checks pass.
• StartOS: tsc --noEmit and the 17 tests pass under Node 22, the version CI uses.
• Umbrel: umbrel lint finds nothing, and the store's own npm run lint:apps -- epochbtc-satd --check-images in a fresh clone of getumbrel/umbrel-apps reports "No issues found".

Not in this PR

• Syncing the stores (sync-store.sh umbrel|startos) runs from this merge commit. For StartOS, the README also asks for an install on a StartOS box first.

🤖 Generated with Claude Code