attest v0.2.0
Hardening release. Security fix: attestations are now bound to their commit, rejecting cross-commit signature replay. Plus prominent trust-model docs, cleaner errors, commit-status checks, and a CI provenance ledger that grows on every push.