v0.1.0-alpha.2

Second alpha of the AgenTrust Telemetry contract, and the first release published through the trusted-publishing pipeline. 0.1.0-alpha.1 exists on npm only as the bootstrap publish RELEASING.md sanctions; PyPI has never been published, so this is its first version.

What changed

• Wire spec_version now matches spec/VERSION (#41). The envelope schema pinned a const of 0.1.0-dev while every package declared 0.1.0-alpha.1, so an adopter emitting the release version would have been rejected by the validator.
• Schema $id moved off agentrust.io (#42), a domain we do not own that serves a parked lander and answers HTTP 200 for every path. Identities are now under agentrust-io.com.
• The npm dist-tag is derived from spec/VERSION (#43), so a prerelease can never publish under latest and the release workflow no longer has to be told which phase it is in.

Also fixes a dead test case: test_repository_gates.py had one contract version as a dict key twice, so the dev phase had never been exercised.

Verification

check_versions reports contract=0.1.0-alpha.2 python=0.1.0a2 npm=0.1.0-alpha.2. 13/13 conformance fixtures, 111 Python tests, 41 TypeScript tests, and all four repository gates pass on main.

Still alpha: the contract may change incompatibly, and the SDK validates declared metadata without proving any producer's claim is truthful.