v0.2.0

Re-read before you act; locks never ask you to judge their holder

Safety fixes for running more than one roll, or losing your session mid-roll.

• Stale plans are refused. Each shard is re-read under its shard lock, and again before every restart and failover. If a role, state or build changed since the plan (another roll, another operator, an automatic failover), the shard is skipped untouched (ErrStale). Rerun to replan.
• hammerdown unlock shows who holds a lock and whether that process is running. It releases the lock only with --reason, and only if the holder is provably gone. It refuses while the holder runs, there's no --force, and every release is logged to unlock.log.
• "lock is held" explains itself. The message says whether the holder is running and what to do. It no longer suggests deleting the lock.
• A dropped SSH session drains the roll (SIGHUP) and releases its locks, instead of killing the process mid-roll.

For backend authors: implement fleet.ShardInventory (ShardNodes) for cheap per-shard re-reads, and see CLAUDE.md invariants 7 and 8.

No flag defaults changed.

Full changelog: v0.1.0...v0.2.0 · PR #6