v0.2.1 - test coverage closeout (86% → 94%)

Patch release. No API changes; extends test coverage and pins behaviour known to be broken so future fixes show up as flipped tests.

Test coverage

• 232 tests pass (was 154 in v0.2.0).
• Line coverage 86% → 94%.

What's covered now

• Mode B (encrypted-mask) paths for the v0.2 metric ports (per-rate _difference / _ratio family, scoring disaggregations, regression disaggregations).
• Plaintext fallback when upstream Fairlearn lacks equal_opportunity_difference / _ratio and the per-rate _difference / _ratio helpers.
• Context lifecycle: set_default_context, reset_default_context, make_evaluator_context (TenSEAL).
• CLI residuals: stdin verify, oversize envelope, missing public key, legacy metric envelope key.
• Audit edge paths: SmallGroupWarning emission, no_sensitive_features trust-model label, encrypted_sensitive_features trust-model label, unknown-metric KeyError.
• validate_envelope negative branches: tampered hash, bad schema version, allowed-metric mismatch, depth ceiling, age ceiling, security-bits floor.
• EncryptedVector edges: __neg__, __sub__ (ct−pt and ct−ct), mul_scalar, first_slot, __radd__.
• Multi-column sensitive features (covers _to_dataframe arr.ndim==2 branch).

Known issue pinned

CKKSContext.make_evaluator_context() on the OpenFHE backend currently raises TypeError: cannot pickle 'openfhe.openfhe.KeyPair'. The TenSEAL backend works correctly. A test pins the OpenFHE behaviour so a future fix (wrapper around KeyPair) flips the test from passing to failing instead of going unnoticed.

Backward compatibility

No breaking changes. pip install --upgrade fairlearn-fhe.