docs: sync v0.2.1 public truth

[CoderDeltaLAN]

Summary:

• Syncs SECURITY.md with the published v0.2.1 GitHub Release and PyPI package state.
• Removes stale README wording about post-v0.2.0 unreleased governance fixes and pre-publication PyPI workflow state.
• Rewrites CHANGELOG v0.2.1 release notes as published-state notes.

Validation:

• PyPI v0.2.1 verified before patch.
• Local checks passed: 118 tests, Ruff, text hygiene, Git whitespace.
• Stale wording guards passed for SECURITY.md, README.md, and CHANGELOG.md.

Scope:

• Documentation only.
• Does not touch code, tag, release, PyPI, or workflows.