[codex] Draft sbom-diff-and-risk v0.6.0 release notes

[stacknil]

Brief Design Summary

This PR adds draft v0.6.0 release notes for sbom-diff-and-risk, focused on machine-readable report consumption and JSON summary-output usability.

The notes cover the stable JSON summary fields from PR #26, the report schema documentation from PR #27, and the optional --summary-json PATH CLI output from PR #28. They also document compatibility boundaries, verification/evidence surfaces, and distribution status.

This PR only drafts release notes. It does not bump package version, create a tag, publish a GitHub Release, or publish to PyPI/TestPyPI.

Files Changed

• tools/sbom-diff-and-risk/RELEASE_NOTES_v0.6.0.md

Validation

• git diff --check
• Confirmed relative links in RELEASE_NOTES_v0.6.0.md resolve.
• Confirmed the diff is limited to the release notes file.
• Confirmed no changes to pyproject.toml, src/sbom_diff_risk/__init__.py, SARIF/sample metadata, workflows, or production PyPI configuration.

Out of Scope

• No package version bump.
• No tag creation.
• No GitHub Release creation.
• No PyPI or TestPyPI publishing.
• No production PyPI workflow.
• No runtime behavior changes.