SunLitSecurityLibraries v0.2.1

All twelve public libraries are released at 0.2.1.

• Fix authorization-cache reuse after role changes, including role removal and grants. Manual cache entries cannot seed internal authorizer decisions; public APIs, TTL and capacity remain compatible.
• Update rustls 0.23.45 to 0.23.46 for four newly reported advisories while preserving the rest of the audited dependency graph.
• Require official checksum-pinned OSV scans before dependency builds, including nested security-tool lockfiles, and retain daily scanning and Codex/Claude admission rules.
• Remove the redundant example-service DAST job following its registry quota failures; retain the library test and static/security gates.
• Admit each exact packaged Cargo graph before verification or upload. Bind package source, manifest authority, dependency checksums and verified published sibling versions.

Validation: 1,387 all-feature workspace tests, workspace Clippy, 42 admission/CI Python tests, Linux/macOS/Windows CI, CodeQL and Semgrep pass. All twelve downloaded registry archives match their published checksums and clean source commit d5142b70275f45f2ee2ffa0ed24aad9976583547. All 27 release payload signatures were verified against this repository's tag workflow identity; twelve exact packaged dependency SBOMs validate against CycloneDX 1.6.

The metadata/signing tag is 50ed2f3c404995a28e42f36da22fd1c36f9aea2f. Package source remains the reviewed source commit above. Exact, owned and expiring existing advisory exceptions remain documented; OSV does not prove absence of unknown malware. Mobile adapter/native work is a subsequent release.