Release Opcore 0.2.0

[tomdps]

Opcore 0.2.0

This release makes the default robustness loop lighter on large repositories, strengthens validation correctness, and repairs the publication path that blocked the earlier 0.2.0 attempts.

Highlights

• Bound product scan validation output instead of retaining and serializing unrestricted diagnostic payloads.
• Make validation file views lazy for checks that only need path-specific reads.
• Send committed clone-analysis inputs as paths, with content overlays only for changed or hypothetical files.
• Replace Python syntax heuristics with parser-backed ast.parse validation and honest missing-interpreter degradation.
• Add native validation-policy parity and its package guardrails.
• Accept npm's workspace-keyed packlist JSON during bundle staging.
• Create the GitHub release from the checked-in, readable docs/release/v0.2.0.md notes.

Scope

The memory changes reduce several major scan and validation pressure points. They do not close the broader large-monorepo memory epic; graph working sets, language-service isolation, bounded history/sidecar payloads, and memory regression harness work remain tracked separately.

Verification

• Feature PR CI passed on dev.
• Release-path PR fix(release): publish 0.2.0 with readable notes #229 passed CI, provenance, and CodeQL.
• Full local CI-equivalent gate passed, including 95 Rust tests, 798 Node tests, installed-package smoke, release/cutover receipt validation, and retained current-tool checks.

The main PR gate must additionally build and aggregate darwin-arm64, darwin-x64, and linux-x64 native packages before merge and publication.