Prepare and publish signed OTPBar v2.0.0

[tanRdev]

Prerequisites

• Production migration readiness issue is complete.
• main quality workflow is green.
• Configure the six Apple signing/notarization repository secrets documented in docs/releasing.md.

Acceptance criteria

• Set version 2.0.0 consistently in package.json/package-lock, Cargo.toml/Cargo.lock, and tauri.conf.json.
• Run all release gates.
• Tag v2.0.0.
• Release workflow produces a Developer ID signed, notarized, stapled, Gatekeeper-approved DMG and SHA-256 checksums.
• Verify clean installation and launch on a separate macOS account/machine.
• Publish release notes covering migration, PKCE OAuth, encrypted state, clipboard lease safety, conservative defaults, and manual update policy.