v0.2.0

Zerover: the API may still change before 1.0.

Milestone 2 and milestone 3, plus a fail-safe for operator outages.

Eviction webhook. An observe-only admission webhook on pods/eviction sees
every eviction attempt, including those the PDB then rejects, so drainers
that neither cordon nor taint are now covered. It always admits and is
fail-open. It surges only for pods covered by a PDB this operator owns, so an
unrelated eviction on the same node does not disturb protected workloads.

Cloud sentinels. An optional DaemonSet reads the cloud's termination
notice and taints its own node with the deadline. The core decodes that as an
involuntary signal and can now decide between holding the eviction and
releasing it immediately. In v0.1.0 a spot interruption reached the operator
only as an ordinary drainer taint, so it was held blind against a hard
termination wall. AWS is validated against real spot interruptions driven by
Fault Injection Simulator. GCP and Azure probes are covered by unit tests
only and should be treated as experimental until run on GKE and AKS.

Operator-down fail-safe. The operator heartbeats the PDBs it owns and a
CronJob deletes those whose heartbeat has gone stale, so an outage degrades
to plain Kubernetes rather than leaving a blocking PDB behind. Verified live:
the stale budget was removed automatically once the operator stopped.

Also in this release: a metrics Service, image pull secret support, and a
chart that no longer doubles the release name.