chore: prepare 0.1.0-alpha.2 OIDC release

[tensornull]

Summary

• bump the package, lockfile root, Release Please manifest, changelog, and public release status to 0.1.0-alpha.2
• remove the one-time alpha.1 token bootstrap and manual recovery jobs
• require the exact verified tarball to publish only through npm Trusted Publishing, while preserving the absolute artifact path fix and registry/provenance checks

Why

0.1.0-alpha.1 used the documented one-time token bootstrap because npm could not configure a Trusted Publisher before the package existed. The package now exists and its Trusted Publisher is configured for cometapi-dev/cometapi-node, publish.yml, and the protected npm environment. Alpha.2 is the required OIDC-only proof release.

Verification

• npm run verify
• node scripts/validate-release.mjs --tag v0.1.0-alpha.2 --release-prerelease true --require-final --require-releasable-docs
• 175 tests passed
• exact tarball, ESM, CommonJS, compatible OpenAI host, minimum/locked/latest OpenAI, actionlint, secret scan, and standalone-copy gates passed