[Pepps233]

Summary

Record the public CLI 0.2.1 bootstrap and retirement of the original eleven 0.2.0 package versions.

Reasoning

The owner approved publishing the exact locally validated replacement after GitHub blocked final CLI validation because of account billing or an Actions spending limit.
The evidence distinguishes accepted registry operations, verified public bytes, and remaining live checks.

Changes

• Retain the published source identity, tarball checksums, registry versions/tags, and npm publisher configuration.
• Record anonymous npm/Bun installation checks and retirement verification.
• Document the owner-approved GitHub validation exception and the credential scope checks that require the workflow on main.

Testing

• Published bytes match the approved SHA-256 and SHA-512 identities.
• Fresh anonymous npm/Bun installs passed CLI startup, exports, installed-file hashes, native modules, WASM, and HTML export, with cleanup confirmed.
• The shared cloud release contract passed.
• Local source checks and the isolated test suite passed for the implementation in feat(release): configure private-source npm publication trust #212; final GitHub validation was explicitly waived by the owner.
• Production probing still returned no announced release (404), healthy readiness (200), and anonymous auth rejection (401).

npm rejected latest tag removal with HTTP 400 after 2FA approval, so both bootstrap and latest currently resolve to 0.2.1.
The no-latest acceptance condition and the live credential scope checks on main remain open.