[codex] release: prepare v0.2.0

[jinyounghub]

Summary

• Bumps package version to 0.2.0.
• Moves unreleased changes into the v0.2.0 changelog.
• Updates README and ROADMAP language for the v0.2.0 release scope.
• Strengthens the release checklist with dataflow JSON/SARIF checks, dist-tag verification, and dogfooding follow-up.

Release scope

• config file support
• rule disable, severity override, path exclude, and config suppressions
• baseline support
• finding fingerprints and active/suppressed/baselined report state
• improved GitHub expression handling and one-step env data-flow detection
• improved R104/R105 evidence
• verified AI action catalog metadata and documentation
• contributor onboarding docs and beginner-friendly synthetic fixtures

Verification

• npm.cmd ci
• npm.cmd run lint
• npm.cmd test
• npm.cmd run build
• npm.cmd audit --audit-level=moderate
• npm.cmd pack --dry-run
• node dist\cli.js scan .github\workflows --format markdown --fail-on never
• node dist\cli.js scan tests\fixtures --format markdown --output $env:TEMP\awi-fixtures-v020.md --fail-on never
• dataflow fixture JSON scan and JSON parse
• dataflow fixture SARIF scan and SARIF JSON parse
• restricted public phrase search

Publish, GitHub release, v0 tag movement, dogfooding, and post-release metrics will follow after this PR merges.