v0.2.1

Loom v0.2.1

Release-pipeline fixes that landed after the v0.2.0 tag, so that a plain tag
push produces a complete, verifiable release.

- The publish job checks out the repository before downloading artifacts; it
  previously failed on the missing artifact verification script after every
  artifact had already been built, signed, and attested.
- SHA256SUMS is attached to the release. scripts/install.sh fetches it and
  verifies the binary against it, so the documented installer could not
  succeed for any earlier release.
- The SBOM is checksummed and signed; the checksum and signature jobs
  previously ran without it.
- container-scan no longer filters its push trigger by path, so a release
  commit that touches only VERSION and documentation still satisfies the
  release gate.
- The Python, TypeScript, and Rust SDK User-Agent strings track the release
  version again.

The v0.2.0 tag is unchanged.