v0.2.0 — community Compose and fresh vault credentials

Community Docker Compose deployment with mandatory fresh Bitwarden/Vaultwarden credentials at every execution.

• Pull a versioned GHCR image for amd64 or arm64; local builds and host Python are contributor workflows.
• Configure a dedicated vault account, API credentials, master password and exact Login item UUID. Direct DEGIRO credential environment variables are rejected.
• Follow the root README for Ghostfolio authentication, discovery, mapping, persistent state permissions, DRY_RUN review and scheduling.
• Failed scheduled runs, including DRY_RUN, alert through optional Apprise; successful runs remain silent.
• Upstream release/source watches open review issues without changing versions or deploying.
• Remove personal deployment material and fix the CodeQL logging regression without weakening privacy coverage.

Breaking configuration change: migrate to the documented BW_* variables before upgrading. Keep DRY_RUN=1 until the proposal is reviewed. Preserve mapping and state volumes; record the previous image digest and restore that digest for rollback. No production deployment or financial mutation is included in this release.

Validation: 1,454 offline tests and native amd64/arm64 container CI passed on PR #45. The maintainer merged PR #45 with an explicit CodeRabbit override. The release workflow gates image publication with security scans, native smoke checks, a synthetic community journey, SBOM and provenance. Registry publication is tracked separately from source release publication.