2.0.0

Changed

• Advance managed harness pins to their promoted heads: nddev-codex-app
dc6db75 → e8ee019 (config-ownership + overlay-preservation fixes) and
  nddev-zcode-app 66f7639 → 4457f07 (source-graph plan/apply collision
  parity), matching the nddev-harnesses expected heads.
• Sync agent-facing docs to the executable contract: CloakBrowser 0.4.12,
  Chrome DevTools MCP 1.6.0, uv 0.11.30 across AGENTS/README/SECURITY/CLAUDE,
  the install and browser-routing docs, and the release-validation memory.
• uv/bun are the only package managers. Remove python3-pip from the apt
  baseline; publish only the managed node launcher (npm/npx/corepack no longer
  on PATH); pin uv/bun source tools; bump uv to 0.11.30.
• Server profile is container-execution-only (was server-build-runtime):
  no host build-essential/pkg-config; project builds/tests run in Docker.
• One owner per harness (breaking): remove the inline Claude Code, OpenCode,
  MiMoCode, Antigravity, and raw ZCode installers; delegate codex and zcode to
  the nddev-codex-app / nddev-zcode-app modules via RLDYOUR_CODEX_MODULE /
  RLDYOUR_ZCODE_MODULE.
• Zsh runtime completed: SHA-pinned antidote plugins + zsh-abbr, offline
  static bundle materialization, starship/atuin/carapace pinned standalone
  artifacts (macOS-parity), opt-in reversible login shell; drop the mise shim.
• Bun selects the x64-baseline artifact on non-AVX2 CPUs.
• ~/.zshenv.secrets is no longer sourced by every zsh (agent/secret isolation).