feat: release ContentCloud v0.2

[wutongci]

Summary

• add V2 local-first Source, Knowledge, Brief, CreativeBatch, ScriptPackage and LocalRun workflows
• add V2 CLI/MCP contracts, JSON Schemas, XLSX export, publish/pull coverage and bundled Skill updates
• add invite-based registration with atomic memory/PostgreSQL redemption and concurrency protection
• add no-Docker systemd deployment infrastructure with ClamAV disabled by default
• align the V2 roadmap, implementation status, release metadata and production deployment guidance

Security and data safety

• PostgreSQL invite redemption locks the resolved invite row and permits exactly one concurrent redemption
• invitation lookup remains behind the existing SECURITY DEFINER boundary before tenant-scoped row locking
• workspace path validation resolves symlinks before enforcing the workspace boundary
• core migration no longer depends on the unused pgcrypto extension

Verification

• go test -race ./...
• go vet ./...
• pnpm --dir web test (9 tests)
• pnpm --dir web typecheck
• pnpm --dir web build
• gofmt and git diff --check
• bundled Skill frontmatter and agent YAML parse successfully

The PostgreSQL integration suite remains environment-gated by CONTENTCLOUD_TEST_DATABASE_URL; deployment verification will exercise the production migration and health path.

Release

• application/package version: 0.2.0
• GitHub tag: v0.2
• deployment: systemd Server + Worker behind the existing Nginx reverse proxy