Add pks rm and bump the version to 0.6.0

[dduugg]

Summary

pks rm packs/foo deletes a pack along with what other packs say about it. It removes the pack from their dependencies, ignored_dependencies and visible_to lists, drops the violations their package_todo.yml files record on it (deleting a todo file that ends up empty), and then deletes the pack's directory. Deleting the directory by hand leaves pks validate failing on dependencies that name a missing pack (packwerk-extensions rejects such visible_to entries too) and pks check failing on stale todo entries.

Unless given --force, it refuses to remove a pack that other packs may still use, because once the pack is gone check can't see their references to it:

• If other packs reference its constants, it lists each one as file:line:column and the constant.
• If it has Ruby files under lib/ (other than lib/tasks/) that are outside the autoload roots, the Zeitwerk resolver never learns their constants, so references to them can't be checked. Gem-style packs keep their code there, and without this check a gem pack used across a large app was deleted without objection. The experimental parser reads definitions from every file, so the check is skipped with it.

The root pack can't be removed, and neither can a pack with other packs nested inside it, even with --force.

This PR also bumps the version to 0.6.0, so merging it releases v0.6.0.

Fixes #16.

Release

• auto-release.yml dispatches the v0.6.0 release once this lands on main, since Cargo.toml's version has no tag yet. 0.6.0 is a minor bump because pks rm is a new feature.
• ## Unreleased in the CHANGELOG is now ## 0.6.0, the heading dist takes the release notes from.
• Two user-visible changes in this release had no entry, so 320accf adds them: auto-correct keeping comments in package.yml (Preserve comments when auto-correcting unused dependencies #60, using the entry Preserve comments when auto-correcting unused dependencies #60 suggested) and the warm-cache speedup from skipping unchanged files (Skip reading source files on a warm cache hit via mtime + length #59).

Stacked on #60

#60 is from a fork, so it can't be this PR's base. This branch merges #60's head instead, and until #60 lands the diff here includes it. The commits for review are the ones that aren't merges:

• e7df158 makes package_todo.yml writes return errors instead of panicking, so rm can report them.
• 2a4de4a moves Preserve comments when auto-correcting unused dependencies #60's checker/dependency_removal.rs to pack_list.rs, unchanged.
• 6b5f3a7 generalizes it to all three lists and adds rm.
• 320accf bumps the version and prepares the CHANGELOG.

3d2061b merges main, for #68 and #69. Once #60 merges, I'll rebase onto main and drop both merges, along with the #60 CHANGELOG entry if #60 adds its own. Merging this PR first would ship #60 in 0.6.0, entry included, and #60 could then be closed.

Design notes

• package.yml files are edited as text, with Preserve comments when auto-correcting unused dependencies #60's edit-then-verify approach, so comments and key order survive. Rewriting through serde, as add-dependency does, reorders keys: on copies of two large apps it changed most package.yml files even when nothing else changed, and rm can touch many files at once.
• An emptied visible_to becomes visible_to: [], which is what serializing the pack writes, so the in-place edit and the fallback rewrite agree.
• Todo files lose only the removed pack's entries. Regenerating them with pks update would also pick up any unrelated drift.
• The directory is deleted last. A partial delete can take package.yml with it, and then rm could no longer find the pack to clean up the references to it.

Who this affects

• pks rm is new.
• check-unused-dependencies --auto-correct now shares rm's editing code. Its fallback warning names the lists it couldn't edit and gives the path relative to the project root.
• pks update reports a failure to write a todo file as an error and exits 2, where it used to panic.

Test plan

• tests/rm_test.rs: a removal that touches every kind of reference, checked byte for byte and followed by passing validate and check; refusals for references, for unresolvable lib/ code, and for both at once, each leaving the fixture unchanged; --force; the root pack; nested packs; an unknown pack; a trailing slash; and the fallback rewrite.
• Unit tests for the generalized editor: every list at once, an emptied visible_to, and a flow-style visible_to it declines to edit.
• Breaking the lib/tasks/ exclusion or the visible_to: [] behavior fails tests.
• On copies of two large apps, refusals listed 2,461 and 248 references and changed nothing. Forced removals changed only the removed entries' lines in each package.yml, and the todo files lost only the removed pack's blocks. Afterwards validate passed in both. check matched its baseline in one, and in the other reported the leftover references against the pack that defines an enclosing namespace, which is how the resolver already treats a missing constant.
• pks --version prints pks 0.6.0, and CHANGELOG.md has the exact ## 0.6.0 heading that auto-release.yml checks for.
• cargo test (354 passed, with Don't infer a constant from a polymorphic association #68 and Check the pks version before taking the cache's stat fast path #69 merged in), fmt, and clippy with -Dwarnings.
• CI passes.