chore(release): prepare v0.2.0

[trionnemesis]

What changed

Cuts v0.2.0. Every location carrying the version moves together, so the release workflow's tag-matches-pyproject guard has nothing to catch, and CHANGELOG.md records what happened since 0.1.0.

The headline for the entry: in 0.1.0 the entry point was the harness itself, which could not be reached without a configured target — an allowlist entry, a staging agent, usually a SIEM. agentsec scan needs a checkout and nothing else.

File	Bump
pyproject.toml, src/agentsec/__init__.py	0.1.0 → 0.2.0
packaging/claude-desktop/manifest.json	0.1.0 → 0.2.0
README.md, README.zh-TW.md, site/index.html	gate pin @v0.1.0 → @v0.2.0
.github/workflows/agentsec-gate.yml	usage comment pin
.github/workflows/release.yml	example tag in the header comment

Merging this does not publish anything. The release fires on a v* tag push, which is a separate deliberate step after this lands.

Type

• New scenario (Attack–Detection Contract)
• Evidence collector
• Executor
• Evaluator / verdict logic
• MCP gateway surface
• Docs / ADR
• Fix

Purple coverage

Question	Answer
Which scenario(s) cover this change?	None. No scenario, fixture or executable path is touched — the only code change is the __version__ string.
Does it change how a verdict is produced?	No.
Does it widen what the MCP gateway can reach?	No. Tool surface stays at 11, resources at 10.

Checks

• make check passes (ruff clean, mypy clean on 63 source files, 379 tests pass)
• agentsec validate --strict passes on all 8 scenarios
• Both version readers agree: pyproject and agentsec.__version__ return 0.2.0, which is what the release workflow compares against the tag

Notes for the reviewer

Three claims in the changelog were wrong on the first draft and are corrected against the code — worth spot-checking, since a changelog is exactly the document nobody re-verifies later:

1. Twelve rules, not ten. len(RULES) is 12. The "ten" figure came from feat(inspect): converge on a repository-first golden path (#32) #33's own PR body and was already stale when written.
2. PUBLISH_SCHEMA_VERSION did not exist at 0.1.0. I first wrote "1.0.0 → 1.3.0", implying a migration path across the release boundary that no consumer ever saw. It ships here at 1.3.0, having moved three times inside this cycle.
3. Two new ADRs, not seven. 0003–0007 were already in the 0.1.0 tree; only 0008 and 0009 are new.

One judgement call: this is 0.2.0, not 0.1.1. repo_risk is a required property on the composed dashboard, and AGT-CONFIG-003's retag changes which risks it correlates with — both visible to a strict consumer, neither a patch-level change.

README.zh-TW.md gets only the gate-pin bump here; its scope facts (4/10 coverage, four scenarios) remain stale from the English README sync in #34. Called out in the changelog's own terms rather than quietly shipped — happy to follow up before or after the tag.

---

Generated by Claude Code