v0.2.1

gator auto now reads the roles file, which is how roles were always meant
to work.

The controller resolved roles from the environment only, so the documented
mechanism — a roles file, no model id in the code, no shell profile edited —
did not apply to auto. Worse, it failed opaquely: with no model resolved the
placeholders went through unsubstituted and the host answered with its own
Unknown provider "%PROVIDER%".

# ~/.config/gator/roles
planner = yeti/DeepSeek-V4-Flash    # used by `gator auto plan`
heavy   = yeti/DeepSeek-V4-Flash    # fallback, and what `feed` uses

Precedence lives in one place. The shell script already implemented it —
environment, then the repository's file when trusted, then yours — and now
resolves planner, heavy and planner_cmd before handing over, so the
controller receives answers rather than re-deriving the rules in a second
language. A missing planner role refuses with planner_role_not_configured and
says what to set.

Model references from a roles file go through the same validator feed uses,
since auto substitutes them into a command too.

No test caught this: every planner in the suite is a stub. That is a gap in the
tests as much as a bug in the code.

Upgrading from v0.2.0 is deno task install; nothing else changes.