UNASKED v0.2.1 - Non-certifying M0 development path

Scope

UNASKED v0.2.1 is the first public source-visible release of the P0 evidence-authority
foundation and unsealed M0 development execution path. It adds public governance and
automated security review while preserving the v0.2 claim boundary.

This release is explicitly NON_CERTIFYING:

• m0_demonstrated=false;
• public visibility is not research evidence;
• no independently held sealed benchmark was used;
• trials certify fails closed until custody and complete evidence bundles can be
  independently authenticated;
• the local executor and subprocess provider do not prove OS-level network or filesystem
  isolation;
• actor IDs and external custody/replay issuers are recorded but not cryptographically
  authenticated.

Changes since v0.2.0

• add a reserved-rights LICENSE and explicit contribution, security, support, conduct,
  issue, and pull-request policies;
• add CodeQL, Dependabot, Bandit, and locked dependency vulnerability auditing;
• pin current Node 24 workflow actions by immutable commit;
• replace remaining runtime assertions at security/integrity boundaries with explicit
  fail-closed handling and regression tests;
• keep reproducible build, exact metadata/member allowlists, tag binding, checksum, and
  wheel smoke-test gates.

NO_VERIFIED_DISCOVERY remains a valid and expected result.