chore(release): bump version to 0.2.1

[oabolade]

Version bump for the v0.2.1 patch release.

Why patch, not minor

Every change that ships in the wheel since v0.2.0 is a bug fix. No new public API, nothing breaking.

PR
#25	fix(security)	log injection — tool_name off the MCP proxy wire reached two logger calls unescaped
#27	fix(security)	same guard reshaped so CodeQL can see it; output byte-identical
#28	fix(sdk)	both console scripts were unusable on a bare install — rootsign version, --help, verify --local, and every rootsign-admin command died on ModuleNotFoundError
#30	fix(sdk)	missing postgres extra now names the install command on every DB-backed path, not just some
#33	fix(cli)	single import style for importlib

#29 / #31 / #32 (test + CI) and #26 (actions bump) change nothing in the distribution.

postgres_extra_required was added to rootsign.errors but is not exported from rootsign/__init__.py — internal helper, so no public surface change.

Scope of the diff

Two lines. rootsign/_version.py reads the version from installed distribution metadata, so pyproject.toml is the only place it's written.

README's Status headline moves to v0.2.1. The phase table's ✅ v0.2.0 row for 1.5 stays — that records when the feature shipped, which is history, not the current version.

Verification

Reinstalled and confirmed the bump propagates everywhere it matters — including SDK_VERSION, which lands in every envelope's sdk_version field:

rootsign.__version__ = 0.2.1
SDK_VERSION          = 0.2.1
rootsign version     → rootsign 0.2.1

Then built the artifacts and smoke-tested the wheel in a fresh no-extras venv, so the #28 fix is confirmed in the thing that would actually go to PyPI:

rootsign version        -> rootsign 0.2.1
rootsign --help         -> exit 0
rootsign-admin --help   -> exit 0
rootsign verify <uuid>  -> install hint, exit 1
DB packages resolved    -> none

Full suite: 500 passed, 6 skipped.

🤖 Generated with Claude Code