Composer reads a ^0.4 caret on a 0.x package as >=0.4 <0.5, so this package
could not be installed alongside a server running Resonate v0.5. Widen the
constraint to ^0.4|^0.5; the suite passes against v0.5.1 unchanged.

Also backfills the changelog for v0.2.1, which shipped the CI workflow, the
Pint and PHPStan gates, and the null-safety refactor of TokenAuthPlugin that
came with them.