v0.2.0

role-call v0.2.0

Phases one and two complete: the application built in twelve
review-gated subphases, and the same digest-built image running on
local Kubernetes behind default-deny network policies, restricted pod
security, digest-pinning admission, and workload identities with
nothing to steal. Every control carries the test or probe that proves
it; the decision record runs D-001 through D-050.