v0.2.2

- Fix state-snapshot RBAC: split create from name-bound verbs.
- Drop the placeholder Secret from the install manifest and make the Helm
  Secret conditional; re-apply / helm upgrade no longer wipes credentials.
- install.sh bootstraps an empty Secret only when one is missing.
- Quieter defaults: warning_events ignores reasons already covered by
  pod_crashes / job_failed, plus the k3d InvalidDiskCapacity quirk.
- Add Tilt-based local dev loop with in-cluster webhook sink and broken-
  workload triggers; documented under Contributing.