v0.2.0 — gated operator API + DS plugin-kit adoption
Security: the operator CRUD/transition routes move to the bearer-gated /api/plugins/project_board prefix (plugin-view rule 2) — previously creatable/transitionable without the bearer on token-gated deployments. Public-of-necessity stays: /board, /webhook/pr (HMAC), /features/{fid}/ci. Kit: dynamic-import plugin-kit.js (ESM — protoContent#224), initPluginView + slug-aware authed apiFetch. Needs protoAgent ≥0.27 (unchanged). From the 2026-06-12 plugin-ecosystem hardening pass.