v0.2.2 — Post-v0.2 detection and operability

Summary

Ships the post-v0.2 detection and operability backlog on the usable-tool line.

Highlights

• Async evidence emit (AsyncEvidenceSink, evidence backpressure)
• Variant B payload-backed EXFIL via eBPF write()/sendto() first-256 overlap
• openat + sensitive_paths and DNS (sendto:53) as SUSPICIOUS
• Bounded overlap expansion (depth-2 nests, gzip_base64, same-call JSON reassembly)
• Startup cross-server tool-shadowing detection
• Concurrent HTTP load p99 + eBPF ringbuf DropCount tests

Verify

git fetch --tags
git -c gpg.ssh.allowedSignersFile=allowed_signers tag -v v0.2.2

Full changelog: CHANGELOG.md