docs: migrate --status + manifest-free copy-forward; bump 0.6.1.0 (EGB-710)

CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to a four-digit MAJOR.MINOR.PATCH.MICRO version scheme.
 
+## [0.6.1.0] - 2026-06-08
+
+### Changed
+
+- **`secrets migrate` copy-forward is now manifest-free (EGB-710)** — the
+  per-project step enumerates the store's `*.gradle-properties.age` blobs
+  directly (the same source of truth `--finalize` uses) instead of reading
+  `.secrets.json`. A legacy `.secrets-files`-only project now migrates cleanly
+  instead of dead-ending with "No .secrets.json", and a store blob the manifest
+  no longer declares still gets a v2 twin (so `--finalize` won't refuse it).
+  Running migrate in a project with no v1 properties blobs is a clean no-op.
+
+### Added
+
+- **`secrets migrate --status`** — a read-only survey that walks every project
+  in the store and reports its v2 readiness (v2-ready / migrated / NEEDS
+  MIGRATE), then whether the store as a whole is finalize-ready. Exits non-zero
+  while any v1 blob is un-twinned, so it can gate the path to `--finalize`.
+
 ## [0.6.0.1] - 2026-06-08
 
 ### Added