AINRA v0.2.0 — the reference CLI goes hybrid Ed25519 + ML-DSA-65

The downloadable reference CLI goes hybrid — Ed25519 + ML-DSA-65, both-or-invalid.

What this release delivers. The one-file reference CLI now signs and verifies with hybrid Ed25519 + ML-DSA-65 everywhere (keygen, issuance, certs, checkpoints, status), at parity with the Rust core and the browser SDK — still a single self-contained download that runs with just node. Suite Migration Drill 01 proves a real Ed25519→hybrid migration over a running network with fail-closed alg_downgrade semantics and an auto-expiring opt-in overlap. The distributable genesis ceremony runs FROST 5-of-9 across nine isolated OS processes; witness kit v2 ships a single-binary witnessd.

Proof. The full 17-row preflight board ran ALL GREEN from a clean clone at this exact commit — committed as docs/releases/v0.2.0-board.md. The attached SHA256SUMS is signed with the project's offline release key (release/ainra-release.pub at the current tip); verification steps: RELEASE-VERIFY.md.

Honest status. Single-key root pending the recorded public ceremony; local witness keys pending independent witnesses; the three real-world genesis DoD rows unmoved.

Full changelog: CHANGELOG.md → [v0.2.0].