chore: bump version and changelog (v0.5.0.0)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to a four-digit MAJOR.MINOR.PATCH.MICRO version scheme.
 
+## [0.5.0.0] - 2026-06-07
+
+### Added
+
+- **`secrets verify` (EGB-698)** — a read-only integrity check. Run it in a
+  project to cross-check the committed `.secrets.json` against the store both
+  ways (entries declared but missing from the store, and stored blobs with no
+  manifest entry) and decrypt-test every blob with your current key. Catches a
+  partially-synced store, a stale key, or a manifest that has drifted from the
+  store. Plaintext is streamed to `/dev/null` and never written to disk.
+- **`secrets verify --all`** — decrypt-tests every blob in every project in the
+  store: a fast store-wide integrity sweep. (The store carries no manifests, so
+  `--all` checks decryptability only, not manifest consistency.)
+- Both modes recurse the whole project tree, so nested entries and external
+  files are covered. `secrets verify` exits non-zero on any problem, so it can
+  gate CI or a future store migration.
+
 ## [0.4.0.0] - 2026-06-07
 
 ### Added