0.6.11: Add verified domains and agent affiliations

[alex-w-99]

Executive Summary

Adds verified organization domains and agent affiliations to the Python, TypeScript, Rust, and CLI packages in version 0.6.11.

• Manage TXT challenges, verification, explicit transfers, and claim release.
• Select an agent's domain with an explicit public-display choice.
• Search public agents by verified domain and parse optional A2A affiliation assertions.

Description

Adds organization-domain resources and identity affiliation methods across all three SDKs, plus organization-domain and identity domain-affiliation CLI commands. Public directory methods and iterators carry the exact-domain filter across pages. A2A participant, message, and webhook types expose optional domain assertions and the actual webhook message sender.

Updates examples, skills, integration scenarios, and the changelog. SDK/CLI versions, lockfiles, User-Agent constants, and the Claude plugin move to 0.6.11; the bundled Codex and Cursor manifests receive patch bumps to 0.1.6 and 1.0.4.

Reason

Developers need to associate agents with domains their organization controls and inspect that affiliation through the same SDK and CLI surfaces used for A2A.

Decisions

• Publication: Require an explicit public-display choice when setting an affiliation; hidden affiliations remain visible to authorized A2A participants.
• Compatibility: Optional response fields tolerate absent assertions and domain states remain forward-compatible; Rust exhaustive struct literals must include the new fields, with ..Default::default() available for directory options.
• Release: Use the next patch version, 0.6.11, and publish the TypeScript SDK before the CLI because the CLI depends on it.

Testing

• Python: uv run ruff check ., uv lock --check, and uv run pytest --no-cov -q passed; 1,099 tests passed, 3 skipped.
• TypeScript: npm run build and npm test -- --run passed; 1,098 tests passed, 3 skipped.
• Rust: cargo test passed 262 tests; cargo test --features tunnels-runtime passed 345 tests, with 3 doc tests passing in each run. cargo fmt --check and cargo clippy --all-targets --all-features -- -D warnings passed.
• CLI: npm test passed all 135 tests using a locally packed TypeScript SDK 0.6.11.
• client.organization_domains.create/get/verify/transfer/delete (Python), client.organizationDomains (TypeScript), and client.organization_domains() (Rust): preserve TXT instructions, timestamps, unknown states, encoded claim IDs, and pagination.
• inkbox identity domain-affiliation set helper CLAIM_ID --visibility hidden: sends an explicit false publication choice; omitting --visibility fails before making a request.
• inkbox a2a directory --public --verified-domain example.com: carries the filter and cursor; organization scope rejects the filter.
• Live integration scenarios are included but were not run against a deployed API in this pass. No packages were published.

Release dependency

Release after the organization-domain API is available. Publish @inkbox/sdk before @inkbox/cli, then release the Python and Rust packages according to RELEASING.md.

[dimavrem22]

codex: [P2] The minimum supported version here is incorrect: these resources and commands are introduced by this PR’s 0.6.11 release, not 0.6.5. A reader retaining 0.6.5–0.6.10 cannot run the examples. Please align all seven README/skill occurrences with the actual feature release version, and keep that floor synchronized if the version changes while updating this branch to current main.

[dimavrem22]

codex: [P1] Choose an unused release version before publishing this stack. @inkbox/sdk@0.6.11 is already present on npm; I inspected its package and it does not contain OrganizationDomainsResource. Main also assigns 0.6.11 to email-send idempotency and is now at 0.7.0. This PR cannot publish the new SDK under the occupied 0.6.11 version. Update the lockstep package versions, dependent CLI version, manifests and changelog to the next available release, then align the documented feature minimum with that release.