release: recover controlled alpha as v0.1.0-alpha.2

[wms2537]

Relates to #25

Outcome

Recovers the controlled-alpha publication as v0.1.0-alpha.2 without rewriting the immutable, unpublished v0.1.0-alpha.1 candidate tag.

Changes

• aligns package, lockfile, client, workflows, provider manifests, docs, and changelog on 0.1.0-alpha.2
• documents the immutable failed alpha.1 candidate and superseding alpha.2 boundary
• replaces an invalid raw predicate-URL assertion with tested structural validation of decoded BuildKit SLSA provenance and SPDX 2.3 SBOM documents
• fails closed on malformed provenance, incomplete SPDX document metadata, empty inventories, and invalid package identifiers/names
• retains immutable digest inspection, anonymous pull, image smoke, Kertas conformance, evidence recording, and only-then tag promotion

Verification

• exact commit: 373d715ab3de084fa64a84e8affb8df529afbaab
• npm run release:version with v0.1.0-alpha.2: PASS
• strict validators against retained real alpha.1 registry evidence: PASS
• focused workflow/attestation tests: 13/13 PASS
• exact clean npm run release:gate: 470/470 PASS, zero audit findings
• gate evidence: release-evidence/2026-07-22T09-19-22-889Z
• exact image config digest: sha256:36d3310b1f6b5c44829037d63dc5dd95398591cf494f88ce63a9089dfc885d76
• exact image smoke plus standalone Kertas conformance: PASS
• independent specification review: PASS
• independent release/security review: PASS after malformed-SPDX blocker was fixed TDD-first

The alpha.2 tag will be created only after this PR and its exact post-merge main gate pass.