Release Open Receipt v0.2.1

[JasonSmall]

Summary

Synchronize the standalone public repository to the already-published Open Receipt 0.2.1 package and current public specification.

• add the authoritative v0.2 trust-aware verifier and schemas
• document issuer metadata, purpose-bound key lifecycle, historical verification, attestations, checkpoints, assurance semantics, and v0.1 compatibility
• preserve the v0.1 source, schemas, vectors, tag, and release history
• add the 30-case deterministic v0.2 trust catalog and explicit canonical/historical parent-reference coverage
• verify Node 20, Node 22, TypeScript consumer, browser ESM, build, and package behavior
• harden the release workflow to verify and skip an exact package version that already exists on npm

Why

@receiptprotocol/open-receipt@0.2.1 is already published and current, while this standalone repository still presented v0.1. The public source and release history should match the published package without republishing npm.

Validation

• bun run check — 57 tests passed; typecheck and build passed
• release lint command passed
• TypeScript consumer example compiled
• browser ESM bundle built
• packed installs passed on Node 20.20.2 and Node 22.23.1
• npm pack --dry-run inspected 17 intended public package files
• npm registry confirmed latest and exact version 0.2.1
• secret/private-production-key, absolute-path, and out-of-scope application-code scans passed
• README local links and public URLs verified

No npm publication, deployment, production mutation, application server code, migrations, operator tooling, private data, or secrets are included.