Hive v0.6.1 — Security fix for rust_brain snapshot restore, PyPI distribution, and refreshed dependen...

[0.6.1] - 2026-06-29

Security

• rust_brain snapshot integrity: RustBrain.snapshot_to_file now embeds the
  SHA-256 of the node payload in the file, and restore_from_file verifies it
  before mutating state. Previously the checksum was computed and discarded, so
  a corrupted or tampered snapshot restored silently. A failed check now raises
  ValueError("snapshot checksum mismatch ...") and leaves the existing store
  untouched. Backward compatible: pre-checksum snapshots skip verification.

Added

• PyPI publishing in the release workflow (trusted publishing via GitHub OIDC).
• [full] optional extra: busybee-cpu + honey-comb pulled from PyPI.
• docs/PYPI.md with one-time publisher setup instructions.

Changed

• Dependency pins refreshed across core, dev, observability, and GPU extras.
• hive_api_server reads version from hive.__version__ instead of a hardcoded string.

Tests

• Replaced the catch-all corruption test with deterministic checks: content
  tamper → checksum ValueError, restore atomicity (existing data survives a
  failed restore), and truncated-file framing failure.