Activate verified CLI 0.5.1 channels and trusted Cargo workflow

[konojunya]

Summary

• Activate the official stack-diagram-cli Cargo channel and synchronize release metadata, Aqua locks, and installation/upgrade guidance to 0.5.1.
• Consume the merged canonical documentation/skill bundle.
• Add a manual, main-only OIDC publication workflow with a non-publishing default and immutable-version guards. Owner trust configuration remains a separate required step.

Published evidence

• Initial Cargo publication and all eight registry-only install jobs succeeded: https://github.com/stack-sh/cli/actions/runs/33989181749
• Four-target signed, reproducible native release succeeded: https://github.com/stack-sh/cli/actions/runs/33989469273
• Homebrew 0.5.1 lifecycle matrix passed and the formula update is merged.
• Aqua 2.62.3: all four target mappings and isolated native installation/command/assets checks pass.

Local validation

• 69 JavaScript tests, 12 Python tests, actionlint, distribution/skill checks
• Downloaded native release: 17 checksums, source/version metadata, native signature/runtime/command verification
• Published registry-only Cargo install and generated skill workflow smoke

Existing tags, native assets, source crates, and historical schemas remain immutable.