release: v0.5.1 (dependency-refresh point release)

[zvndev]

Summary

Cuts v0.5.1 on top of the shipped v0.5.0 foundation. This is a dependency-refresh point release — the only change that reaches a published artifact is the zeroize 1.8.2 → 1.9.0 bump (used for in-memory secret scrubbing in powdb-auth and powdb-server). Everything else that landed on main since the v0.5.0 tag is CI/dev/docs only.

What's in v0.5.1

Change	Reaches published artifact?
zeroize 1.8.2 → 1.9.0 (#100)	✅ powdb-auth, powdb-server
Explicit nightly fuzz toolchain pin (#98)	❌ CI only
dtolnay/rust-toolchain SHA bump (#99)	❌ CI only
postgres test-harness + @types/node dev bumps (#100)	❌ dev only
Remaining-work backlog docs refresh (#100)	❌ docs only

No runtime or wire-protocol changes. PowQL, SQL frontend, storage format, and the wire protocol are byte-for-byte identical to v0.5.0.

Version bumps

• Cargo workspace 0.5.0 → 0.5.1 (all 8 crates via workspace.package)
• TS client package.json version + CLIENT_VERSION → 0.5.1 (kept in sync for the ci.yml ts-client consistency gate)
• CHANGELOG.md [0.5.1] entry + RELEASES.md current-release pointer
• Cargo.lock regenerated

Verification

• cargo check --workspace clean (all crates report 0.5.1)
• TS client tsc build clean; package.json / src / dist all report CLIENT_VERSION = "0.5.1"
• CHANGELOG entry verified against git log v0.5.0..main — no published change is over- or under-claimed

After merge: tag v0.5.1 → release.yml (build + smoke gate + GitHub release + Docker), then publish.yml (crates.io, dry-run first) and npm publish for the TS client.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}