chore(release): v0.2.0

[chad-loder]

Summary

Cuts v0.2.0. Stamps the version in src/yarlpattern/_version.py and adds a v0.2.0 section to CHANGELOG.md describing the six PRs that landed since v0.1.0 (PRs #17–#25).

v0.2 highlights (full text in CHANGELOG)

• URLPattern.generate(component, groups) implemented — closes the only tentative-spec gap. 19 / 19 upstream WPT cases pass.
• PEP-8 snake_case primary, camelCase aliases preserved — compare_component / has_regexp_groups are canonical; compareComponent / hasRegExpGroups are kept as IDL-faithful aliases. No breaking change.
• WICG polyfill conformance corpus vendored alongside WPT — 328 polyfill cases pass, 8 documented divergences skipped.
• SPEC_DEVIATIONS.md — explicit accounting of where yarlpattern delegates, where it's stricter than yarl, and the now-empty list of tentative-spec gaps.
• MDN + WHATWG spec example tests — pedagogical examples locked in as regression tests.
• Self-benchmark suite — yarlpattern-only across the four hot paths, gated behind a PEP-735 bench group.
• Security-shaped example — regex-allowlist credential-leak walkthrough using invoke-ai/InvokeAI#7518 as the seed case.

Conformance

• WPT: 469 / 469 across all five suites (was 450 + 19 skipped on v0.1.0)
• Polyfill: 328 / 336 (8 documented divergences)
• In-repo total: 951 passing, 8 skipped (v0.1.0 baseline was 580 passing)

TestPyPI dry-run

The release pipeline was rehearsed end-to-end before opening this PR:

• gh workflow run nightly.yml dispatched against main → green
• Resulting wheel yarlpattern-0.1.0.dev20260513 published to TestPyPI via Trusted Publishing
• gh attestation verify passed on the wheel + sdist
• pip install --index-url https://test.pypi.org/simple/ --pre from a fresh venv pulled the package cleanly
• Smoke test verified: test / exec / generate / compare_component / compareComponent (alias) all work as expected

Test plan

• uv run pytest -q — 951 passed, 8 skipped
• just lint — all tools green
• just docs — strict-mode build clean
• just compliance-report — regenerates as 469 cases, 0 failing
• Signed commit (ED25519)

After merging

1. Merge this PR (squash).
2. just release-tag 0.2.0 to create the signed annotated tag and push it.
3. Tag push triggers .github/workflows/release.yml → builds with PEP 740 + SLSA attestations → gh attestation verify → pypa/gh-action-pypi-publish to PyPI via Trusted Publishing → draft GitHub release with checksums → release published.

Known follow-up (not in this PR)

The just release-prepare recipe currently switches to release/v0.2.0 before invoking semantic-release version, but PSR's branches.main filter only stamps when running on main — so PSR no-ops and the recipe's user has to stamp manually (as done here). Tracked for fix in a follow-up PR.