Release 2.6.0 step 1: bump version to 2.6.0

[cliffhall]

Summary

Bump the root package.json version from 2.5.0 to 2.6.0 on v2/main, ahead of the v2.6.0 milestone merge into main. Carries the release npm audit report and any fixes it forces, in the same PR.

Why

Per the release skill, the audit, its fixes and the version bump are all part of the milestone's work and belong on the develop branch (v2/main), so they flow into main together. Doing the bump on the milestone-merge branch instead leaves v2/main reading a stale version and risks it leaking into unrelated PRs (#2010).

Scope

• npm audit --audit-level=high across the root and all four client installs — report only, never npm audit fix (it resolves in-range advisories by silently downgrading; see High-severity nanoid advisory in the production tree (via vite → postcss), on both branches #2058).
• Any fix the report forces, as its own commit — a direct bump or an overrides entry.
• Root package.json: 2.5.0 → 2.6.0 (there is one version number in the repo; the clients carry none).
• package-lock.json updated by npm version minor --no-git-tag-version.

No tag is created here — the release tag points at the merge commit on main, cut separately in step 2.

Acceptance

• npm audit --audit-level=high run and reported for root + web/cli/tui/launcher
• Root package.json reads 2.6.0 on v2/main
• No 2.6.0 git tag created by the bump
• npm run local:gate passes