[0.2.0] Qualify one exact release candidate and publish the evidence dossier

[mberrys]

Problem
PR #188 is a 195-commit release PR with no body. The previous #197 gate is coupled to GUI work that is now explicitly post-0.0.3. The release needs a narrow, evidence-bearing gate for the actual 0.0.2 contract.
Candidate manifest

{
  "release": "0.0.2",
  "candidate_sha": "<dev-sha>",
  "base_sha": "<stable-sha>",
  "checks": {},
  "artifacts": [
    {
      "name": "Loupe-0.0.2-x86_64.AppImage",
      "sha256": "<digest>",
      "sbom": "<path>",
      "attestation": "<url>"
    }
  ],
  "known_limitations": [],
  "rollback": {
    "stable_sha": "<pre-release-sha>"
  }
}

Required evidence

• source-integrity result
• Windows/Linux build and complete test results
• architecture/documentation truth
• curated fuzz regression
• supply-chain policy
• developer and release manifest verification
• package install/launch smoke
• Loupe/engine version assertions
• issue acceptance crosswalk
• known limitations and waiver decisions
• rollback procedure
  Acceptance criteria
• PR 0.0.2 #188 has a complete body and links the candidate manifest.
• Every artifact derives from the exact candidate SHA.
• Stable remains untouched until all required evidence is green.
• A rerun cannot silently substitute a different source SHA.
• Every unresolved issue is explicitly deferred with owner and milestone.
• The final release merge and tag match the qualified candidate.
  Supersedes: Complete release validation and the Loupe 0.0.1 exit gate #197 for 0.0.2.