release: add Web Graph authority evidence for v0.6

docs/VALIDATION.md

@@ -1,5 +1,27 @@
 # Validation
 
+# Version 0.6.0 Web Graph and updater validation, 2026-09-22
+
+The evaluation contract was written before implementation. The new Common Crawl
+domain-rank integration passed five default integration tests; its sixth test is
+an explicit resource benchmark. The benchmark parsed 100,000 valid provider-shaped
+rows, retained exactly one identity-matched domain, and completed in 0.52 seconds
+of test time. The enclosing warm Cargo process used 79,944 KiB peak RSS, wrote
+9,136 filesystem blocks, and used no swap on the development machine. These are
+engineering bounds, not a full 2 GiB provider-object throughput claim.
+
+`scripts/check.sh` passed after the v0.6 version and Rustls lockfile updates. It
+covered formatting, offline all-target checks, strict Clippy, all Rust and CLI
+tests, documentation, Python release-package tests, and native/Python consumer
+parity. The focused graph suite proves full-stream schema/value validation,
+source-line provenance, gzip authentication, exact URL allowlisting, deterministic
+builds, compact candidate-domain selection, and zero route authorization from
+rank evidence.
+
+The networked `cargo audit --deny warnings` gate initially detected
+RUSTSEC-2026-0285 in Rustls 0.23.43. The lockfile was updated to Rustls 0.23.45;
+the repeated audit passed with no findings.
+
 ## Version 0.5.0 release and security validation, 2026-09-13
 
 Implementation commit: `557ba7cd6982b02754d34fb99cba5a116f78f153`, signed by