v0.2.0 — audit remediation

Remediation release from a full audit of the runner, compiler, installers, and docs (PRs #9–#13). No loop spec format changes — version: 1 loop.yaml files compile unchanged.

Highlights

• Runs on the declared Python floor again: datetime.timezone.utc replaces the 3.11-only datetime.UTC (#9 by @kenstephoang, fixes #8). CI now enforces 3.9–3.13 across ubuntu/windows/macos (#10).
• Loop control fixed (#11): fixed_passes gates complete cleanly instead of tripping the stall detector on their own synthetic marker; nested-JSON judge verdicts parse (previously every structured verdict silently degraded to revise); a no-progress stop actually stops the run; gate-boundary resume works; failures are recorded in state.json.
• Security hardening (#11, #12): consent fails closed for any non-local council member; context gathering honors configured redactions; redaction globs match nested paths (config/.env); workspace/context paths are confined to the loop directory at compile time and runtime; register-model refuses credential-shaped values.
• Windows first-class (#11, #13): UTF-8 subprocess I/O, correct venv path resolution in SKILL.md, LF-stable generated artifacts, BOM-tolerant reads, and installer/skill detection of the Microsoft Store python stub (verified on real hardware).
• Compiler as a gate (#12): timeouts on every external invocation, empty-argv/negative-budget/duplicate-id rejection, null-tolerant parsing, schemas reconciled with the real compile contract.
• Project hygiene (#13): CHANGELOG, CONTRIBUTING, uninstall docs, documented ~/.looper/models.json footprint, repo topics.

Full details in CHANGELOG.md. Tests: 7 → 16, all green on the full CI matrix.