release: v0.6.4 — first release carrying the provenance API

[hartsock]

What this PR does

• Lock-step workspace bump 0.6.3 → 0.6.4 (workspace.package.version + the five internal =0.6.3 pins + Cargo.lock)
• First release to carry the merged content-addressed authority provenance API (feat(protocol): content-addressed authority provenance — Authority/Grant + resolved-authority lattice + L3 admission (#134) #72/#134): Authority/Grant + AuthorityId/GrantId, the resolved-authority lattice, ScopeRelation, relate/admit/check_derivation/verify_chain
• Additive-only over v0.6.3, verified by diffing the tag: authority.rs is wholly new; caveats.rs is doc-only; user_key.rs has zero public-signature changes; one new dependency, the published content-addressable = "0.1.0"

Test plan

• Full pre-push gate green locally: just check (fmt + clippy -D warnings + tests) + just cov-ci (75% floor)
• cargo publish --dry-run -p agent-mesh-protocol green — packages and builds in isolation against the crates.io registry (proves the content-addressable dep chain resolves published, not path)
• CI on main green at the feat(protocol): content-addressed authority provenance — Authority/Grant + resolved-authority lattice + L3 admission (#134) #72 merge commit (782bd47), including the macOS job

Out of scope

• No code changes — version + lockfile only. Publishing happens via the existing tag-driven release.yml (v0.6.4 tag → wheels to PyPI + crates to crates.io in dep order) after this merges.
• Downstream: agent-bridle #329 collapses its temporary native lattice to a thin re-export of this API (separate PR in that repo, pinned agent-mesh-protocol = "0.6.4"), removing the second copy of the security algebra before the bridle 0.8.0 line freezes.

---

Note

Low Risk
Version and lockfile-only changes with no runtime or API edits in this diff.

Overview
Release-only PR: bumps the workspace from 0.6.3 to 0.6.4 with no source edits—only Cargo.toml (workspace.package.version and the five internal =0.6.4 path pins) and matching Cargo.lock entries for all agent-mesh crates.

This tags the first crates.io/PyPI release that includes the merged provenance API from earlier work (Authority/Grant, lattice, derivation checks, content-addressable dependency). Publishing is expected after merge via the existing tag-driven release workflow.

^{Reviewed by Cursor Bugbot for commit 9c1c1c0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_2c9ea35d-6500-4f3e-bd3e-c63bbf15c67b)