Prepare v0.2.0 release

[rob-p]

Summary

• cut the v0.2.0 changelog, including upgrade notes for DecodeReport and the new index API
• document the complete pinned FASTQ release qualification across single-member, multi-member, and BGZF inputs
• fix release version updates in Cargo.lock while keeping registry dependencies locked
• allow release dry-runs from clean preparation branches while retaining the main requirement for real releases
• avoid invalid token environment variables masking valid stored GitHub CLI credentials
• allow the fair benchmark runner to use prebuilt Rust helpers from scratch storage

Release qualification

On the 44-physical-core Xeon E5-2699 v4 release host, all 576 timed cross-tool attempts and every byte-for-byte preflight succeeded. Across the 16 FASTQ cells, rapidgzip-rust reached:

• 1.47x–14.77x C++ rapidgzip with zlib-ng, 3.71x geometric mean
• 1.35x–10.92x C++ rapidgzip with ISA-L, 2.87x geometric mean
• at most 45.1% of the zlib-ng build's peak RSS and 42.7% of the ISA-L build's peak RSS

The ordinary Read and actual paraseq matrices also passed all single-member, sparse/dense multi-member, and BGZF cells at 1, 4, and 16 configured workers with 8 KiB and 1 MiB consumer buffers.

Validation

scripts/bump_and_publish.sh --dry-run 0.2.0 passed from this clean branch. It temporarily bumped all workspace packages to 0.2.0, then completed locked checks, formatting, clippy with warnings denied, all-target tests, warning-free rustdocs, and crates.io package verification for rapidgzip-core and rapidgzip-rust-cli. Both uploads were aborted by Cargo's dry-run mode, and the version files were restored.

This PR does not publish crates, create a tag, or create a GitHub release. After merge, the real release still requires an explicit invocation from clean main.