release: v0.2.0 — CI builds on tinyjs v0.50.1

The Studio gained the security story (threat model, adversarial suite,
Gate UI, security page), Phase 1 parity (badge, external links, duplicate,
reset data), the Nativefier importer, and tracks the 0.47–0.50 runtime.
The release workflow now builds with tinyjs v0.50.1 instead of the
pre-wrap v0.42.2 pin.

studio: one-click tinyjs setup for the packaged app

Fresh install of the .app/.exe/Linux build had no tinyjs to drive and
told the user to go install it by hand. Now the Studio offers the
official tinyjs.app installer in-app: a setup card replaces the stage
when no CLI is found, one click runs curl|sh (Windows: irm|iex) with
every line streamed into the console, and resolution re-runs against
the absolute install path — no PATH editing, nothing else touched.

The status line now reports version + wrap support (probed via the
wrap usage line, since unknown commands exit 0), and the Wrap tab
honestly says 'not in this release yet' while Create/Run/Build work.

workflow: drop --sequesterRDir (unrecognized on the macOS runner)