release: cut v0.2.0

[rldyourmnd]

The control plane pins this module by release tag, so nothing merged since v0.1.3 reaches it until this exists.

A minor bump, not a patch: the contract breaks, and the version number is the first place a consumer reads that.

Breaking

• A Task manifest stating a zero timeout, max_output_bytes or max_context_bytes is refused rather than widened to a default. Manifests that omit a bound are unaffected.
• security-tools.json no longer accepts upstream_go_mod.
• The release contract gains graph_only_modules, and its schema requires it.

What is in it

Six merged changes (#54–#59) closing every finding from the forensic review of main@a656bf7, plus five found while doing the work. The recurring shape: controls that could not fail for the reason they claimed, and declared bounds that were not the bounds that held.

The [0.2.0] section is written once and sealed — releaseNotes() slices it verbatim into a published, immutable asset, so a stale line becomes a permanent one. I generated the asset from this commit and read it back before pushing.

Verification

Full suite under umask 022, 002 and 077, -race, gofmt, go vet, staticcheck v0.7.0, and all seven contract checkers. All green.

One test was found restating the release version in a fixture changelog; it now derives it from the contract, so the next bump cannot leave the fixture describing a release that is not the one under test.

After this merges — needs you

The tag is annotated and SSH-signed by the owner, which no agent can do:

gh api repos/NDDev-it-com/agent-runtime/immutable-releases --jq '.enabled'   # must be true
git tag -s v0.2.0 -m "agent-runtime v0.2.0"
git push origin v0.2.0

The immutable-releases precheck is manual by design — the publishing job's token has no admin read, and as of this release docs/releasing.md says so instead of claiming the workflow does it.

Afterwards github-device-sync moves its modules/agent-runtime gitlink to the v0.2.0 tag commit. It currently sits on a656bf7, two commits past v0.1.3 and not a tag at all — which the module's own anchor now declares it should not be.