release(0.2.0): the contract gained a MUST, so the tag has to move

A runtime that conformed to v0.1.0 does not conform to this one until it declares the
set of commons data files it implements (spec section 1.1). In 0.x that is a minor
bump by the rules, but it is breaking in substance, and the CHANGELOG entry says so
rather than leaving a consumer to discover it in a failing suite.

Both consumers were notified by coord before this tag existed, which is the wrong
order in one respect: they were told to expect a contract change they could not yet
vendor. README says to vendor a tag and never main, so the notice was unactionable
until now. Tagging closes that gap rather than opening a new one.

Version sync: README's subtree-add and clone examples pinned v0.1.0 and now pin
v0.2.0; the subtree-pull example is a placeholder rather than a version, since it
demonstrated "move to a newer tag" while naming the current one. The two remaining
v0.1.0 mentions are historical statements about what that release promised and stay
as they are.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CVouC9nsfrfV5jRSejxbvQ

CHANGELOG.md

@@ -11,6 +11,16 @@ case ids, disposition semantics). Each JSON file additionally carries its own
 
 ## [Unreleased]
 
+## [0.2.0] — 2026-08-11
+
+The contract gained a normative MUST, which is why this is a release rather than a
+metadata commit: **a runtime that conformed to `v0.1.0` does not conform to this one until
+it declares the set of commons data files it implements.** In 0.x that is a minor bump by
+the rules, but it is breaking in substance, and a consumer reading only the version number
+should learn that here rather than from a failing suite.
+
+Everything below this heading was previously listed as unreleased.
+
 ### Retracted
 
 - **The claim that the Python guard's port cites `severity.mjs` for hybrid severity.** It is