v0.2.0 — separated-topology evidence surface

Reference policy-verifier authorization surface for the separated
network/pipeline topology (lock-step with provin.oss's cmd/network +
cmd/pipeline recomposition — PR2 evidence-wire and the tlog-mirror surface).

Added

• Reference policy verifier: declare the evidence-write and transparency-log
  resource/actions the separated data plane exercises but v0.1.0 did not
  authorize — chain/report-health (publisher emit-health reporting),
  payloads/retain (by-reference payload deposit), audit/register
  (evidence registration), and tlog/mirror (custody-log mirroring). The
  v0.1.0 image predated these wire calls and 403d them with
  undeclared_resource_action, blocking the provin.oss quickstart's separated
  topology from reaching a VERIFIED verdict.