v0.2.0 — scroll-aware visibility & the index.js harness

Every change traces to a ledgered residual from the 0.1.0 audits.

Added

• In-repo harness for lib/index.js — the fix-audit's top residual (that file carried every P1 and had zero tests). 46 tests total, run against the real host packages.
• Scroll-aware visibility: flags computed against the current scroll window (step scrollTop), disclosed as scrollTop=; unreadable scroll positions are disclosed, never silent.

Fixed

• mp_console walks every buffer page (no ≤2000 assumption); every early exit discloses an unread tail.
• Explicit isConcurrencySafe on all tools; async screenshot IO; probe cache per binPath|cwd.

Verified — four-route live battery (route proven in-band by <imageStatus>):

route	input	result
deepseek-v4-pro	text	PASS
deepseek-v4-flash	text	PASS (10× mp_act under a noisy driver, all clean)
kimi-k2.7-code	[text]	PASS — honest degrade
kimi-k2.7-code	[text, image]	PASS — exactly 1 image block; read button text & colors from pixels

Full evidence: docs/evidence/live-matrix.md