chore: bump version and changelog (v0.6.0.0)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to a four-digit MAJOR.MINOR.PATCH.MICRO version scheme.
 
+## [0.6.0.0] - 2026-06-07
+
+### Added
+
+- **Self-describing store format (v2) + `secrets migrate` (EGB-703)** — the
+  store now records its format in a committed `.secrets-format` file, and
+  `secrets which` prints it (`format: v2`). A fresh `secrets init` creates a
+  v2 store; existing stores read as v1 until migrated.
+- **`secrets migrate`** — copy-forward a project's encrypted blobs to the v2
+  layout. It is non-destructive: the old blobs are kept until you finalize, so
+  a half-migrated store stays fully readable and recoverable. `secrets migrate
+  --dry-run` previews exactly what would change without writing anything.
+- **`secrets migrate --finalize`** — the one destructive step, run once
+  store-wide. It refuses unless `secrets verify` passes and every blob has its
+  new-format twin, cuts a `pre-v2-migrate-*` recovery tag first, then drops the
+  old blobs. It asks for confirmation (or `--yes`) because a machine still on
+  an older `secrets` will stop seeing migrated external files until it updates.
+
+### Changed
+
+- The external `properties` blob is stored as `<name>.properties.age` in a v2
+  store (was `<name>.gradle-properties.age`), matching the manifest `type`.
+  `push`, `pull`, and `verify` pick the right name automatically from the store
+  format, so v1 and v2 stores both keep working during a migration.
+
 ## [0.5.0.0] - 2026-06-07
 
 ### Added

VERSION

@@ -1 +1 @@
-0.5.0.0
+0.6.0.0