Bump version, cut CHANGELOG's Unreleased section into 0.6.8, backfill
changelog entries for the 96 PRs merged since v0.6.7 that were missing
from it, and refresh version-dependent references in README/docs.
This release exists primarily to ship the release-signing hardening
that landed in #1266/#1329 (SLSA build-provenance attestation +
Sigstore signing, with .sigstore.json bundles attached to the GitHub
Release) — v0.6.7 was tagged two days before that fix merged, so every
release OpenSSF Scorecard's Signed-Releases check has seen so far
predates it. Cutting v0.6.8 is what actually exercises the fix.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>