Release: publish the AncestryLLM 0.2.0 CLI

[sodejm]

Goal

Publish AncestryLLM 0.2.0 as the first public SemVer-governed CLI release to PyPI and an immutable GitHub Release.

Required gates

• Improvement: add SQLCipher and keyring first-run diagnostics #13 cross-platform SQLCipher/keyring diagnostics
• Release process: create security and interoperability evidence checklist #19 release evidence process
• Hardening: complete incremental sync rebase, tombstone, and rollback tests #27 incremental sync regression and rollback matrix
• Hardening: add complete one-shot and REPL command-parity tests #28 one-shot/REPL parity
• Hardening: expand RootsMagic export and service boundary coverage #29 RootsMagic export/service coverage
• Performance: route every GEDCOM local-LLM call through the modular LLM service #35 modular provider boundary and provider=none network isolation
• Implement cooperative job cancellation and shutdown #53 cancellation and safe shutdown
• Add end-to-end REPL parity and responsiveness tests #59 end-to-end REPL responsiveness and security
• Hardening: bound file-backed inputs and test safe failure at every ingestion boundary #76 bounded file ingress
• Hardening: add adversarial GEDCOM parse, validation, and lossless serialization fixtures #77 adversarial GEDCOM parsing/serialization
• Hardening: test RootsMagic reader and export against corrupt, incomplete, and hostile SQLite inputs #78 hostile/corrupt RootsMagic inputs
• SemVer/public-contract documentation and global --version
• deterministic wheel/sdist build and clean-install matrix
• release-readiness and trusted-publishing workflows
• protected main/release tags, protected PyPI environment, immutable GitHub releases
• signed annotated v0.2.0 tag
• TestPyPI, PyPI, and GitHub artifact/hash/attestation verification

Release rules

Do not move, delete, or reuse a published version tag. Do not publish from a dirty checkout or with bypassed required checks. Do not claim vendor interoperability without dated fictional-data evidence. If 0.2.0 is defective after publication, issue a new patch release.