chore(release): v0.20.0

A Moshpit name now survives the TLS handshake without a per-name detour.
`dns trust <name>` installs the leaf a name serves, but only when its key
matches a pin the registry already published, and `dns start --trust-all`
does that as names resolve (#279, #281). Minor, not patch: two new ways to
invoke the tool.

Also carries two commands that used to report success they had not earned
-- `update --timer --install` when systemctl refused (#282), and
`site --proxy` with a port outside 1-65535 (#280).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: ralyodio

package.json

@@ -1,6 +1,6 @@
 {
   "name": "moshcode",
-  "version": "0.19.1",
+  "version": "0.20.0",
   "type": "module",
   "description": "moshcode — a metal wrapper for coding engines and native UGig/CoinPay workflow CLIs, with OpenPRD and moshscript",
   "bin": {