chore(release): v2.0.1-aio.2

[JSONbored]

Summary

• prepare the formal mem0-aio v2.0.1-aio.2 release
• update the changelog and CA-facing XML Changes entry

What changed

• records the security/runtime hardening shipped after v2.0.1-aio.1
• includes the signed Ubuntu apt-source preservation fix validated by the successful central publish run

Why

The container and template behavior changed, so this needs a formal release tag and GitHub Release rather than only a main-branch image publish.

Validation

• git diff --check
• uv run --with pytest --with defusedxml pytest
• aio-fleet validate-repo --repo mem0-aio
• aio-fleet trunk run --repo mem0-aio --no-fix

Notes

• After merge, run aio-fleet control-check with publish enabled for the release commit, then aio-fleet release publish.