v2.0.1

Add is_demo registry flag and ship V2 Frame Me challenge

- Inspector flags any key with is_demo=true as DEMO, independent of
  status (active/deprecated/revoked)
- Replace V1 demo identity with a dual signing+sealing keypair and a
  real sealed V2 reference artifact (challenge.vwh)
- Rewrite README Frame Me challenge for the V2 dual-signature model
- Strengthen vwh-core seal-signature tests to call crypto::verify()
  end-to-end (test-only, vwh-core stays 2.0.0)

vwh: 2.0.0 -> 2.0.1