v0.2.2 — API polish and coverage from continued review

Additive polish from the review that did not stop when the milestone shipped. No breaking changes; upgrading from 0.2.x needs nothing.

API, from an independent Rust API Guidelines audit

Sixteen observations, none blocking. Landed here: ChangeId (and Store, TransactionShape, ClientAuth) derive Hash — the change ID is the key applications track submissions by, and it could not be a HashMap key; canton-ledger/canton-admin re-export Auth, ErrorInfo, ResourceInfo so the types their own APIs return can be named without a canton-core dependency; ErrorCategory gains TryFrom<i32>/From<ErrorCategory> for i32; #[must_use] and docs.rs feature badges where siblings had them and these did not.

The audit's two breaking findings are recorded rather than rushed: ADR-0010 commits the *ParseError renames and the removal of Party's unvalidated From<&str> to 1.0.

Tests

Coverage measurement found what four review passes reading code had not: the three TopologyClient list reads and both recovery handles' recover were exercised only by the env-gated live suites, which CI never runs. All hermetically covered now — 363 tests without a node, hand-written code at 87.7% line coverage, cargo udeps clean, and a compile-time proof that every public future is Send.

Adversarial probes against a live Canton 3.5.7 participant, run with the published crates, established the duplicate-submission semantics the mocks simplify: fire-and-forget Submit reports a duplicate through the completion stream (where recover reads it), only the waiting lane rejects synchronously, and the JSON lane's answer is exactly the HTTP 409 + DUPLICATE_COMMAND the SDK's predicate matches. OIDC refresh was driven through a real token expiry against Keycloak.