v2.0.1

A same-day fix to 2.0.0: npm create weave was still scaffolding projects onto 1.x.

The template pinned its dependencies at ^1.0.0, and a caret range does not cross a major — so a brand-new
project created minutes after 2.0.0 shipped installed 1.8.0 and got none of it, including both security
fixes. Exactly the people least able to notice.

The ranges now follow the release major, and a gate (verify:template-ranges) fails the build if they ever
drift again. Nothing else changed.