chore(release): bump version to 0.2.1 - #34

Patch release. Every change that ships in the wheel since v0.2.0 is a bug fix;
no new public API and nothing breaking.

  #25  fix(security)  log injection — `tool_name` off the MCP proxy wire
                      reached two logger calls unescaped
  #27  fix(security)  same guard reshaped so CodeQL can see it; output
                      byte-identical
  #28  fix(sdk)       BOTH console scripts were unusable on a bare install —
                      `rootsign version`, `rootsign --help`,
                      `rootsign verify --local` and every `rootsign-admin`
                      command died on ModuleNotFoundError
  #30  fix(sdk)       missing `postgres` extra now names the install command on
                      every DB-backed path, not just some
  #33  fix(cli)       single import style for importlib

#29/#31/#32 (test + CI) and #26 (actions bump) change nothing in the
distribution.

README's Status headline moves to v0.2.1; the phase table's "✅ v0.2.0" row
stays put — that records when 1.5 shipped, which is history, not the current
version.

`rootsign/_version.py` reads the version from installed distribution metadata,
so pyproject.toml is the only place it is written. Reinstalled and verified it
propagates to `rootsign.__version__`, `SDK_VERSION` (which lands in every
envelope's `sdk_version`), and `rootsign version`.

Built the artifacts and smoke-tested the wheel in a fresh no-extras venv —
the #28 fix holds in the thing that would actually go to PyPI:

    rootsign version        -> rootsign 0.2.1
    rootsign --help         -> exit 0
    rootsign-admin --help   -> exit 0
    rootsign verify <uuid>  -> install hint, exit 1
    DB packages resolved    -> none

Full suite: 500 passed, 6 skipped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>