v0.2.0

Adds a machine-readable form of the same gate. sdlc-controls tier still assigns a risk
tier to a change from its git diff and a declared component map, and enforces that tier's
controls in CI; now --format json emits the evidence record — the tier, why that tier,
what it required, and what the run actually verified — as a schema-validated document. A
new sdlc-controls binding prints the active policy the same way. Text output is unchanged
and remains the default. It still needs no build tool and no network.

See what changed:

sdlc-controls tier --base main --head HEAD --config config/components.yaml --format json
sdlc-controls binding --config config/components.yaml --format json

Each evidence record now carries its own schema_version, the tool name and version that produced it, a verification block separating what the run checked from what it only recorded, and a result block with the pass, exit code, and violations, so a consumer no longer has to observe a process exit code to know the gate blocked the change. The shapes are published as JSON Schema (Draft 2020-12) under schemas/, validated in CI against the JSON the tool actually emits, and versioned independently of the binary: a pinned copy of a schema keeps validating documents from a newer binary, because
every extension point leaves additionalProperties open. The tier scale and exit_code — the sets the algorithm itself fixes — stay closed. docs/contract.md and ADR-0001 write up the three version axes and the stability promise.

Additive upgrade: text output is byte-identical to v0.1.0 and a golden test enforces it, exit codes are unchanged in both formats, and --format json still prints its record on a failing gate. The JSON path serializes explicit wire DTOs rather than marshalling the engine struct, so a future rename inside the engine breaks a build instead of a consumer. The JSON Schema validator is a test-only dependency; the binary is still a single static artifact whose only runtime dependency is gopkg.in/yaml.v3.

Worth knowing before relying on it: the v0.1.0 limits are unchanged. Blast radius still comes from a hand-maintained map, not a computed dependency graph, so an undeclared high fan-in component is under-tiered. CAF-SDLC-011 still checks that two different forge accounts were involved — it cannot tell who prompted the model. Both are written up in docs/controls/. The published schemas are experimental at major 0 while the binary is 0.x: fields may be
added, and a removal or rename bumps the major to evidence/1.

Apache-2.0. Go 1.22+. Reference implementation, not a product.