v0.2.0

Changed

• Minimum Go version is 1.26. Go 1.24 is out of support and its crypto/tls,
  net/http and encoding/asn1 carry unfixed vulnerabilities
  (GO-2026-6090, GO-2026-6089, GO-2026-5972, GO-2026-5856); binaries from
  v0.1.x were built with it. CI and release builds pin the toolchain
  (GOTOOLCHAIN=local) and run govulncheck.

Added

• Proxy detection: target.proxy reports explicit proxies (from the
  transport's proxy function) and TLS interception (verified chain without
  Certificate Transparency SCTs), each with a warning. CLI prints a Proxy
  line.

• Test matrix (docs/test-matrix.md) enforced by TestMatrix; end-to-end
  tests for HTTP/1.1 fallback, flow errors, test_endpoint, TLS 1.2
  normalisation, upload byte cap, custom RoundTrippers, config timeouts,
  the CLI, and the nqserver binary. Nightly Live workflow.

Fixed

• test_endpoint dial override no longer rewrites dials to a proxy that
  shares the origin's host.
• Foreign probes over a custom RoundTripper that reuses connections now yield
  unstaged samples instead of failing outright.
• server.SelfSignedCert returns the parsed leaf certificate, so it can be
  added to a cert pool.