packaging: bump all distro specs to v6.5.2, add bump_version.py

- RPM, Arch (PKGBUILD + .SRCINFO), Debian, Gentoo: 6.3.3 → 6.5.2
- scripts/bump_version.py: bumps version in all 7 files at once
- ipc.py: tighten socket permissions 0o666 → 0o660 (bandit B103)
- CLAUDE.md + CHANGELOG.md: doc updates

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>