v2.0.2

Add registry commit signature check, vwh 2.0.2

Inspector now verifies the HEAD commit of notvcto/vwh-registry via
the GitHub API after a successful registry fetch. If the commit is
GPG-signed, [OK] Registry commit signed is shown. If unsigned, the
inspector warns, finds the last signed commit in the last 20, and
re-fetches keys.json and ledger.json at that SHA to use as fallback.
Check is skipped for --offline and custom --registry URLs.

vwh: 2.0.0 -> 2.0.1