feat(release): prepare v0.2.0 and automate verified draft releases

[eho-send]

What changed and why?

Spec updates previously changed the generated client without proposing a CLI release. Semantic contract changes now include a version and changelog proposal in the existing spec PR; formatting and known documentation annotations do not trigger a release.

After reviewed version changes reach main, Prepare Release checks, builds and smoke-tests macOS/Linux executables for ARM64 and x64 on native runners. A separate writer validates the exact artifacts, source revision, archive format and checksums before creating or resuming a draft release. It never executes downloaded artifacts, replaces release assets or publishes drafts. Existing tag conflicts fail before writes.

This also prepares v0.2.0 for the already merged agent onboarding and refreshed Brale contract. Future drafts require maintainer publication.

Validation

• nub run check: 213 tests passed; typecheck, lint and formatting passed.
• nub run build, nub run knip, nub run jscpd: passed.
• nub run actions:check: SHA pinning verified across four workflows and eight actions.
• actionlint and git diff --check: passed.
• Regression checks observed red before fixes for tag conflicts, partial matrix retries, missing compiler outputs and stale binary metadata, then green.
• Independent review: two bounded rounds plus focused compiler-fix review; no remaining blocking findings.
• Exact v0.2.0 binaries from caa36e811b9c6a677e7b93b8b8292bc7e130b585: all four smoke checks passed (native macOS ARM64, macOS x64 through Rosetta, and network-isolated Linux ARM64/x64 containers).
• All seven required hosted PR checks passed on the current revision: CI run.
• Native Prepare Release workflow and public v0.2.0 publication: NOT RUN; the workflow starts after the required review and merge to main.

Review notes or handoff

A real local all-platform build reported success while missing one executable. Local compilation now runs one target at a time and requires fresh, regular, nonempty executable outputs before writing release metadata. All four canonical output names are checked even for a single-target build. Native workflow jobs remain separate.

Review the spec publisher's four-path allowlist, native build token isolation, same-run artifact validation and draft retry behavior. Version proposals conservatively increment the minor version before 1.0 and major version thereafter; maintainers can adjust after examining compatibility. Tests use fixtures, loopback servers and synthetic credentials.

Requirements and acceptance evidence are recorded in .github/SPEC.md (REQ-REPO-010 through REQ-REPO-014). Required independent human code-owner approval still applies before merge.