v0.2.1

Release v0.2.1

Hot-path refactor + intelligence client signature verification.

Major shipped items (since v0.2.0):
- Async audit emit + blast-radius pre-fetch + DataVolume async (P0-13)
- add_spend persistence + cumulative spend write-back (P0-14, P0-15)
- Catalog signature verify + tier ordering + bundle_url + manifest.signed.json
- tarball_sha256 binding for pack-tarball/manifest pairing
- Stripe v0.3.0 integration scaffolding
- 12 reference policies bundled (AWS-MCP defaults x6, AWS-illustrative x5, others)
- RFC 7591 DCR + RFC 7662 token introspection + OAuth 2.1 metadata
- Mistral + Cohere LLM providers
- Audit CLI subcommands: tail / verify-chain / export / inspect
- 577 unit tests GREEN

Production state: PyPI 0.2.1 already published 2026-05-15 via twine.
This tag triggers GHCR image + ECR mirror + SBOM + cosign attest in CI.