v2.0.0 — enforce the rules in code

From concept demo to hardened workspace: the framework rules are now enforced by code, not just documented.

Highlights

• _core/scripts/sandbox.py — Tier-0 filesystem guardrail wired into every workflow script (out-of-workspace writes and secret files refused in code), with a CI-strict self-test
• _core/SANDBOXING.md — explicit threat model + three isolation tiers, incl. a per-workflow disposable Windows Sandbox launcher
• _core/token-tracker/ — per-run cost accounting (tokens, local-vs-cloud, minutes saved): the automation business case as data
• _core/integrations/ — MCP connectors defined once, projected into Codex / Claude / VS Code configs by gen-harness-config.py
• _core/SMALL-MODELS.md + shared/hooks/deny_secret_read.py — design rules and a harness-level PreToolUse guard that keep workflows safe under small local models
• PORTABILITY.md — the five agnosticism rules and the harness matrix
• workflows/scratch — routing fallback so no task ever improvises a write location
• Per-workflow venvs; ocr-folder now uses a pure-pip ONNX OCR stack (no system Tesseract)
• CI + reproducible provenance manifest (_core/scripts/make_provenance.py)

Full details in CHANGELOG.md.