chore: prepare v0.2.0 release

[zongqichen]

Summary

• move the accumulated Unreleased changes under v0.2.0
• clarify that the Windows implementation is experimental, unsupported, untested in CI, and excluded from release artifacts
• classify state and nested-shim hardening under Security
• update changelog comparison links

This PR prepares the release metadata only. It does not create a tag or publish a Release.

Validation

• make check
• make security
• make release-check
• CFS_REAL_CF=/home/d072944/bin/cf make smoke
• Claude Code Opus 4.8 release-note review and post-fix review

Checklist

• The release notes match v0.1.1..main.
• No credentials, tokens, CF configuration, or sensitive logs are included.
• This change does not create or publish a release.