v0.2.0

Unified auth client contract (B1, #7): client-only package hardened against the Built for Cloud P6 wire (artisan-build/built-for-cloud ^0.12.3). One canonical client-ID and contract-version header per request (case variants removed before send); client identity follows the byte-stable HTTP field-value rule; race-safe persisted identity; pure local install-file utility; proof-of-life route. Removed the cross-package dont-discover of the server provider, so co-installed hosts discover BuiltForCloudServiceProvider normally. Minor bump: behaviour changes for hosts relying on the old discovery exclusion.