v0.2.0

Lazy per-gate TTL re-validation replaces the background sweep: cache
hits re-run only the expired gate (CVE / malware, separate TTLs) and
evict entries that now fail; Docker image verdicts expire and re-run
the full gate with blob cascade. On-demand cache cleanup from the
console. Re-validation load now scales with traffic, not cache size.

See CHANGELOG.md for details.