release: v0.2.0 — hands init, audit log + --dry-run, hands doctor

[askalf]

Summary

v0.2.0 release — bundles three new commands accumulated under [Unreleased] since v0.1.0 shipped to npm. All additive; no behavior change for existing v0.1.0 users. By deepdive's precedent (0.1.0 → 0.2.0 for substantial new feature surface), this is the right minor bump.

• hands init (feat: hands init — interactive first-run setup #20) — interactive first-run wizard. Walks new users through auth (Claude Login vs API Key), optional whisper.cpp voice setup, and surfaces a dario routing tip when ANTHROPIC_BASE_URL isn't set in API-Key mode. Safe to re-run.
• audit log + --dry-run (feat: audit log + --dry-run (SDK mode) #19) — every SDK-mode tool invocation appends one JSONL line to ~/.hands/audit.jsonl (10 MB rotation, two-file cap). hands run --dry-run plans + emits tool calls without executing — agent sees stubbed "success" so the loop completes; audit-logged with dryRun: true. SDK-mode only (Claude Login mode dispatches inside the claude child process; hands can't intercept).
• hands doctor (feat: hands doctor — aggregated health report #18) — aggregated health report mirroring dario / deepdive / claude-bridge. Probes env / config / platform tools / claude CLI / voice / dario reachability. --json for scrapable output.

What changed in this release PR

• package.json — version bumped 0.1.0 → 0.2.0.
• package-lock.json — re-synced (npm install --package-lock-only); 30 packages, 0 vulns, no functional changes.
• CHANGELOG.md — ## [Unreleased] renamed to ## [0.2.0] - 2026-04-25 with a brief release-summary paragraph above the existing per-feature blocks; fresh empty ## [Unreleased] left at the top.

Test plan

• npm install --package-lock-only — clean re-sync, no vulns.
• npm run build — tsc clean.
• npm test — 36/36 pass.
• node dist/cli.js --help — reports v0.2.0 command surface (init listed).
• node dist/cli.js --version — prints 0.2.0.
• Required CI checks (actionlint, analyze / CodeQL, build) on this PR.
• On merge: auto-release.yml fires, runs build + typecheck + test + --help smoke, creates v0.2.0 tag + GitHub release with this CHANGELOG section, runs npm publish --access public --provenance.
• Post-publish smoke (within 10 min of merge): npm install -g @askalf/hands@0.2.0 then hands --version reports 0.2.0 and hands doctor runs end-to-end. Worth catching the bin-shim class of regression that bit dario#143 — same pattern applies to any new package we ship.