v0.2.2 — surface lockstep + release gate

Surface-consistency fix release, cut same-day as 0.2.1. No functional changes
to measurement, storage, or verdicts, and no change to the measured record:
still zero measured KEEPs; the paired Full-vs-Null path remains coded but
unfired.

0.2.1 — the first PyPI release — shipped with internally inconsistent
surfaces: the wheel's skill_harness.__version__ said 0.2.0 while
skill-harness --version said 0.2.1; the PyPI project description (frozen at
upload time) shows a v0.2.0 status banner, a pip-from-git install path, a
broken banner image, and relative links that 404. A PyPI description can only
be corrected by a new upload — that is this release.

Fixed

• skill_harness.__version__ now matches the released version (the 0.2.1
  wheel carried 0.2.0), and the package docstring drops the retired v0.1
  "clause-ablation" framing.
• README: current status banner, pip install skill-harness as the install
  path, and absolute image/link URLs so the PyPI-rendered description
  renders instead of 404ing.
• SECURITY.md no longer hardcodes a version in its supported-versions
  statement.
• publish.yml: all five actions pinned to full commit SHAs (matching the
  repo's existing CI convention), workflow-level read-only permissions.

Added

• Release gate (scripts/release_gate.py), run on every CI push/PR and
  as the first job of the publish pipeline. It checks version lockstep
  (pyproject vs __version__), a rolled CHANGELOG entry, the README status
  banner, README PyPI-render safety, workflow SHA pins, and tag/version
  match. The build and upload jobs depend on it, so a tag cut on stale
  surfaces is blocked by default (not impossible — the workflow itself is
  editable, and the gate cannot reach surfaces outside the repo). Run
  against the 0.2.1 tree, the gate fails with 23 findings; this release is
  its first live pass.