v0.2.1 — Dependency modernization + release governance

Changed

• Modernized dependencies: harbor 0.1.45 → 0.4.0, opik 1.10.39 → 2.0.9.
  Brings upstream bugfixes and removes a long-standing Opik monkey-patch that
  is no longer needed. ConfigurableCodex simplified by ~80 LOC thanks to
  Harbor 0.4 adding first-class support for files-to-inject. (#25)
• Default reviewer model bumped to claude-opus-4-7 across README, ARCHITECTURE,
  bundled nasde-benchmark-runner skill, and example benchmarks
  (ddd-architectural-challenges, refactoring-skill). nasde-dev-skill
  stays on Sonnet 4.6 as documented in benchmark results.

Security

• Added pip-audit as a CI gate. Fixes 20 known CVEs across the transitive
  dependency tree, including 1 CRITICAL and 3 HIGH in litellm / cbor2.
  New vulnerabilities will now fail the quality gate instead of shipping
  silently. (#25)

Added

• CHANGELOG.md, SECURITY.md, docs/RELEASING.md. (#26)

Docs

• README: unified "what NASDE does" opener around four steps, mentioning the
  rough test.sh pass/fail gate that precedes LLM-as-a-judge scoring.
• README: scoring section now calls out that criteria can cover the agent's
  run-time signals — tool-call trajectory, token usage, wall-clock duration —
  alongside the produced artifacts.