Release LowPack 0.2.1 with safe archive migration

[devkyato]

What changed

I thought too on the point that a security-driven format change should not strand the first LowPack archives. This release adds a narrow, checked bridge from format 1.0 to 1.1 instead of silently accepting older manifests in the normal reader.

Oh! On this part, there are two separate tools on purpose:

• lowpack compatibility authenticates and classifies an archive without decompressing or writing anything.
• lowpack migrate keeps the source untouched, preserves the compressed chunk payload area, converts the manifest to schema 2.0, fully reconstructs every file in a sibling temporary archive, and only then atomically publishes the destination.

The README now teaches an actual release-wheel install first, while contributor setup has its own clear path. I also added cross-platform getting-started and compatibility guides, typed Python results/APIs, a fixed format-1.0 golden archive, and hostile/corruption coverage.

Closes #3.

Checks completed locally

• python -m pytest — 66 passed, 3 expected platform skips
• python -m ruff check . — clean
• python -m mypy src/lowpack — strict check clean
• two isolated builds with SOURCE_DATE_EPOCH=315532800 — wheel and sdist byte-identical
• clean wheel install — version, doctor, compatibility, migration, full verify, and unpack passed
• clean sdist install — version and import path passed
• published LowPack 0.1.2 wheel SHA-256 verified, then used to pack 23 files with source dictionaries; the 0.2.1 wheel migrated, fully verified, unpacked, and byte-matched all 23 files
• supplied GitHub cover image matches docs/assets/github-cover.png byte-for-byte

Release intent

This is an alpha patch release. It does not claim forward compatibility, corruption repair, streaming telemetry transforms, or continuous fuzzing. Those boundaries remain explicit in the docs and roadmap.