Atomic bump of headplane and headplane-agent to 0.6.2.
Reworks the NixOS module to track upstream config changes:
- Adds new 0.6.2 options for server (base_url, cookie_max_age, cookie_domain) and OIDC (PKCE, end-session, subject claims).
- Migrates secret options to use _path variants for secure file loading.
- Uses mkRemovedOptionModule for truly removed options (redirect_uri, user_storage_file, strict_validation, cache_ttl).
- Hardens the NixOS test to verify rendered config and session cookie issuance.
- Exposes headplane-agent and tests under headplane.passthru.
