Release v0.2.0

[PurpleReverie]

Summary

Release prep for 0.2.0. Bumps version in package.json, the lockfile, and the CLI's --version output; adds CHANGELOG.md capturing what shipped since 0.1.0.

No functional code changes in this PR — all the behavior shipped in #10.

Why 0.2.0 (not 0.1.1)

A minor bump on the 0.x line because this release:

• adds a new command (weave clean)
• adds new flags (--force on lock, --apply/--force on clean)
• changes observable behavior: lock refuses unpushed commits, post-checkout guards on $3, scan recurses by default, first clones land on the requested branch
• bumps a dependency to clear a high-severity CVE

That's more than a patch.

Checklist

• package.json version → 0.2.0
• package-lock.json synced
• src/index.ts .version() → 0.2.0
• CHANGELOG.md written
• npm run build clean
• ./tests/init-scenarios.sh 46/46 green
• Reviewer: when merged, tag and npm publish from a clean tree

Publishing notes (for after merge)

git checkout main && git pull
git tag v0.2.0 && git push origin v0.2.0
npm publish