chore(release): v0.59.0

[ralyodio]

Bumps package.json to 0.59.0. Nothing publishes from this merge — the GitHub release still has to be cut by hand, and that is what fires publish.yml.

Since v0.58.0:

• cost: read what each session is spending out of the agent CLIs (cost: read what each session is spending out of the agent CLIs #413)
• ci: sync the ThreatCrush pack to 1.7.0 (ci: sync the ThreatCrush pack to 1.7.0, replacing the local scoping fix #412)
• moshpit: publish pages, sections and posts to a name over HTTP (moshpit: publish pages, sections and posts to a name over HTTP #411)
• moshpit: let a name publish a feed, and draw it as a blog or a podcast (moshpit: let a name publish a feed, and draw it as a blog or a podcast #410)
• ci: scope the ThreatCrush PR comment to the files the PR changes (ci: scope the ThreatCrush PR comment to the files the PR changes #409)
• games: put the pong and breakout paddles on the game's clock (games: put the pong and breakout paddles on the game's clock #408)
• moshscript: account verbs, aliases, read verbs, and the newer CLI surface (moshscript: account verbs, aliases, read verbs, and the newer CLI surface #407)
• moshpit: publish the allocation log so it can be mirrored (moshpit: publish the allocation log so it can be mirrored #406)

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

0 finding(s) in the 1 file(s) this pull request changes.

Nothing in the files this pull request changes.

55 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 5 | **MEDIUM**: 44 | **LOW**: 6

Not introduced by this pull request. The full set is in the Security tab.

Severity	Rule	Location
HIGH	js-ssrf-outbound-request	apps/pwa/public/sw.js:45
HIGH	tls-verification-disabled	apps/pwa/src/lib/moshpit-gateway.mjs:299
HIGH	sh-remote-script-execution	install.sh:79
HIGH	sh-remote-script-execution	install.sh:83
HIGH	tls-verification-disabled	src/dns.mjs:741
MEDIUM	sql-template-interpolation	apps/pwa/src/moshpit.mjs:68
MEDIUM	sql-template-interpolation	apps/pwa/src/moshpit.mjs:82
MEDIUM	sql-template-interpolation	apps/pwa/src/moshpit.mjs:108
MEDIUM	sql-template-interpolation	apps/pwa/src/moshpit.mjs:295
MEDIUM	sql-template-interpolation	apps/pwa/src/moshpit.mjs:299
MEDIUM	sql-template-interpolation	apps/pwa/src/moshpit.mjs:344
MEDIUM	sql-template-interpolation	apps/pwa/src/moshpit.mjs:568
MEDIUM	sql-template-interpolation	apps/pwa/src/moshpit.mjs:749
MEDIUM	sql-template-interpolation	apps/pwa/src/moshpit.mjs:751
MEDIUM	sql-template-interpolation	apps/pwa/src/moshpit.mjs:810
MEDIUM	sql-template-interpolation	apps/pwa/src/moshpit.mjs:856
MEDIUM	sql-template-interpolation	apps/pwa/src/moshpit.mjs:926
MEDIUM	sql-template-interpolation	apps/pwa/src/moshpit.mjs:1029
MEDIUM	sql-template-interpolation	apps/pwa/src/moshpit.mjs:1052
MEDIUM	sql-template-interpolation	apps/pwa/src/moshpit.mjs:1074

…and 35 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.