v2.1.0

Automated Skills Library release for tag v2.1.0.

⚠️ This release is a draft. The bundled manifest.json
still contains "signature": "TBD" and is not consumable by
secure-vibe update. The release manager must sign the
manifest offline per SIGNING.md, re-upload
it to the draft, and then run the Sign & publish workflow
(.github/workflows/sign-and-publish.yml) to mark this
release as published.

Assets:

• secure-vibe-<goos>-<goarch>[.exe] — the single binary: CLI + MCP server (secure-vibe mcp), reproducible build. This is what install.sh and Homebrew download, and what go install .../cmd/secure-vibe@latest produces. Reads its library data from --path / $SECURE_VIBE_LIBRARY_PATH (it does not embed the data tree).
• checksums-<goos>-<goarch>.txt — SHA-256 of the binary for that platform.
• manifest.json — library manifest (signed out-of-band before publish).
• secure-vibe-data.tar.gz — library payload (skills, vulnerabilities, dictionaries, dist, rules, compliance, profiles, manifest.json). This is what secure-vibe update downloads by default. The bundled vulnerabilities/osv/ tree is a small latest-first sample.
• osv-cache.tar.gz — full upstream OSV catalogue (osv/<eco>/...). Consumed by secure-vibe dev fetch-vulns --from-release to populate the user cache with complete coverage without hitting osv.dev.
• deltas.tar.gz — patch set against the previous release (best effort).
• SHA256SUMS.txt — checksum of every asset above.

Verification (post-publish):

• Verify the binary with the matching checksums-<goos>-<goarch>.txt file.
• Verify manifest.json with secure-vibe dev manifest verify --path ..
• The Sign & publish workflow runs the same verification in CI
  before flipping the draft to public.