v0.2.0 — Kubernetes-native execution provider

What's Changed

• feat(dx): one-command bootstrap (just setup) + environment preflight (just doctor) by @hrishikeshdkakkad in #21
• feat(ci,dx): non-vacuous CI, supply-chain gate, GHCR distribution, user guides, policy proptests by @hrishikeshdkakkad in #22
• fix(e2e): make no-live mode zero-spend and deterministic (closes the CI flake class) by @hrishikeshdkakkad in #23
• feat: bring your own MCP server, intuitively + authoritative harness/model by @hrishikeshdkakkad in #24
• feat(catalog): connector-catalog bulk import — MCP Registry (primary) + open-connector (supplement) by @hrishikeshdkakkad in #25
• feat(web): unify dashboard and run workflows by @hrishikeshdkakkad in #26
• feat(governance): the Governance page — per-tool permissions matrix + managed overrides by @hrishikeshdkakkad in #36
• docs(web): run-composer pickers — unleak connections, one card vocabulary, working + new by @hrishikeshdkakkad in #42
• feat(scripts): db-clean-tests — a scalpel for test residue, not a reset by @hrishikeshdkakkad in #46
• docs(handovers): commit 2026-07-13 + 2026-07-14 session briefs by @hrishikeshdkakkad in #53
• K8s Phase 0 — provider seam + collection hardening (Docker-only) (#49) by @hrishikeshdkakkad in #54
• K8s Phase 1 — KubernetesProvider + workspaced collector + dual listener (#50) by @hrishikeshdkakkad in #55
• K8s Phase 2 — Helm chart + verified network hardening + per-cloud presets (#51) by @hrishikeshdkakkad in #56
• K8s Phase 3 — CI + provider conformance (#52) by @hrishikeshdkakkad in #57
• fix(k8s): install ring CryptoProvider so the Kubernetes provider boots by @hrishikeshdkakkad in #58
• fix(k8s): numeric runAsUser for bundled LiteLLM by @hrishikeshdkakkad in #59
• fix(k8s): make the kind-calico CI tier a real check (H1) by @hrishikeshdkakkad in #60
• fix(k8s): extract in-tree symlinks in the workspace archive (H4, L4-pack) by @hrishikeshdkakkad in #61
• fix(k8s): helm↔provider wiring — sandbox values reach the provider, digests render, probe gate parity (M3, M9, M10, L12) by @hrishikeshdkakkad in #66
• fix(k8s): reconcile — periodic adopt-or-terminate sweep, graded config errors, node-loss visibility, Docker-parity pre-launch diffs (M5, M6, M7, L9) by @hrishikeshdkakkad in #68
• fix(k8s): cleanups — fail-closed gate resolution, UID-guarded deletes, quiesce replay (L2, L10, L11) by @hrishikeshdkakkad in #65
• fix(k8s): finalizer durability — the persisted intent is the single source of truth (H2,H3,H5,M1,L6,L7) by @hrishikeshdkakkad in #63
• fix(k8s): listener hardening — no /internal on the public plane under K8s (M8, L1, L5, L8) by @hrishikeshdkakkad in #64
• Kubernetes-native execution provider + Helm deployability (release branch) by @hrishikeshdkakkad in #47

Full Changelog: v0.1.0...v0.2.0