v0.2.0

• gaps and the digest report delivery numbers for each repo on its own, never ranked: median PR open-to-merge time, the date the default branch went red (also at the top of the digest), days since the last release with the commits since, the share of releases followed by a patch release within 3 days, and flaky checks (failed, then passed on the same commit). A stale-branches row lists branches untouched for 90 days (stale_branch_days) with no open PR, bot branches excluded; nothing is deleted.
• Dependabot's Agent Package Manager PRs always escalate: apm.yml and apm.lock.yaml count as executed config, because those packages install instructions agents follow. Before, they escalated only because the publish time could not be looked up.
• A lockfile adding a package no longer escalates on its own (decision D14): it escalates only when the new package shares no owner with the packages the same update moves, was first published under 90 days ago, is missing from its registry, has a name one edit from a popular or bumped package, or is a known-compromised version. Otherwise the verdict comment names it as a reason.
• deps holds only the update types a dependabot.yml ignore names (majors only, say), not the whole package.
• gaps recognises staged npm publishing (npm stage publish) and a size budget enforced by a tarball or size script.
• vulns shows each Dependabot alert's scope (runtime or development).
• The act dry run's comment preview now includes close comments; a PR the agent escalates against the rules says so in its comment.
• Removed the unused provider methods open_pr and rate_state.
• keep.py enable: switch on the security settings the maintainer allows without asking (D11), dry run unless --apply.
• act without --apply writes the comments it would post, word for word, beside the plan (<plan>.comments.md).
• A failing bot PR with a known fix says so: the fix, and whether the PR will merge or still go to the maintainer afterwards (prs show, the verdict comment, the digest).
• Fixed: Dependabot's NuGet group PRs ("Updated [x] from A to B") were read as having no versions, so their cooldown was never checked.
• Fixed: deps no longer offers unlisted NuGet versions, and lists packages the repo holds on purpose (ignored in dependabot.yml, exact [x.y.z] pins) apart from bump candidates.
• Fixed: the icon gap now reads F# and VB projects; prs show and state accept a bare repo name; the same lockfile finding in several files is one line.