Summary

Adds read-only v0.2 governance-boundaries release evidence.

This documents:

• main branch protection evidence;
• required status check name;
• admin enforcement;
• force-push prevention;
• branch deletion prevention;
• solo-maintainer PR review profile;
• private vulnerability reporting status;
• explicit limitation that private vulnerability reporting is currently disabled.

Scope

Docs only.

No code, tests, CI, version metadata, changelog release section, tag, GitHub Release, artifacts, PyPI publication, or repository settings were changed.

Verification

Local verification before PR:

• ./scripts/check.sh passed;
• 94 tests passed;
• text hygiene passed;
• git whitespace checks passed;
• staged diff reviewed;
• pre-push diff against origin/main reviewed;
• no obvious sensitive patterns found in the changed file.

Release impact

This closes the v0.2 release-readiness evidence gap for branch protection and required status checks, while documenting that private vulnerability reporting is verified as disabled.

It does not release v0.2.0.