v0.2.0 — telegram-dev

Sherlock external-v3 (12 findings) plus the House audit gap that surfaced with them.

• telegram-userbots/references/rate-and-flood.md passed 100 lines and had no
  ## Contents list. FloodWait pacing, the sanctioned takeout path and the
  errors worth handling by name were all past the fold an agent previews.
• CI now MEASURES the token budget with a real tokenizer instead of estimating it.