chore: release v0.2.0

chore: bump version to 0.1.1, update CHANGELOG

chore: pre-launch final fixes

- SECURITY.md: private disclosure via GitHub advisories, scope notes
- README: uv add install command, fix Development section (uv sync + make check)
- CHANGELOG: add [Unreleased] section per Keep a Changelog convention
- pre-commit: align ruff pin to v0.15.10 (matches uv.lock)