chore(main): release 2.0.1

[github-actions]

🤖 I have created a release beep boop

2.0.1 (2026-09-04)

Features

• add the plan-returning section contract and migrate the workflows section (8a65765)
• contract: extend the plan contract for every migrating section (9ae375c)
• derive list sections from a declarative factory, piloted on labels (71859b5)
• generate action.yml, the inputs table, and the policy and permissions references from declarations (d062cf1)
• generate COVERAGE.md from section declarations (51068cd)
• generate the README sections table, outputs, and PAT form from section declarations (83f3c84)

Bug Fixes

• adopt zod 4.5's native root $ref emission and own-proto rejection (#67) (44dab3b)
• apply review fixes to the docs and tooling sweep (73b6b4a)
• apply review fixes to the harness audit batch (ceb9f46)
• apply review fixes to the src-side audit batch (b9de617)
• attest build provenance and attach the sigstore bundle to releases (b5db672)
• centralize the token-leak sweep in the runner (7dcc225)
• classify rate limits structurally on every path (65f97a2)
• correct mock identity minting and the pages resurrect bug (9152a91)
• cover every faultable section in the fuzz fault battery (e41aa99)
• derive owner-kind sensitivity from the section declaration (0181f01)
• discover schema-corpus scenarios across all scenario roots (d34d031)
• hand sections the parsed settings document instead of the raw one (1ddc2f3)
• harden release boundary checks and decouple the schema id from the release manifest (f5c4c59)
• harden the CI tooling (6fb2603)
• keep spec-pinned gaps out of automatic graduation (ae278c9)
• parse live bodies through parseLive in the seven asserting sections (56ca3e4)
• pass zod's schema layout through instead of guarding it (#68) (64aad27)
• reject required-sections entries excluded by the sections allowlist (c1fc169)
• single-tag releases - version tags live only on packaged commits (08d5585)
• size the harness kill cap for the directed fuzz battery (8543af8)
• strengthen the remaining per-section representations (3fc0f85)

---

This PR was generated with Release Please. See documentation.