Record verified Sized 2.0.0 publication and download acceptance

TODO.md

@@ -18,7 +18,7 @@ Keep the existing CLI useful and preserve the GPL-3.0-only license.
   user, including actual mount boundaries, strict Clippy and a release smoke test.
 - [x] Commit the scanner hardening and Linux check tooling; push the existing
   `sizequeen-scan-hardening` review branch. Remote equality is verified.
-  PR #2 is open; release/tag/package publication remains separate.
+  PR #2 was subsequently merged for the approved 2.0.0 release below.
 - [x] Enable repository Actions and run the same Linux checks on the existing
   cliff-mads runner. Keep its container isolation and other jobs unchanged;
   verify a real workflow result before treating CI as proven.
@@ -48,19 +48,43 @@ on SizeQueen. Website delivery is tracked in that repository's existing queue.
 The owner authorizes pinned core adoption, the public source snapshot while
 keeping the core forge private, and merge/push/publication after checks pass.
 
-- [ ] Replace the local scanner with the exact SizeQueen core pin, verify snapshot
+- [x] Replace the local scanner with the exact SizeQueen core pin, verify snapshot
   hashes and review the CLI/API migration and 2.0 compatibility notes.
-- [ ] Verify Mac arm64 and Linux binaries, source rebuilds without forge access,
+- [x] Verify Mac arm64 and Linux binaries, source rebuilds without forge access,
   dependency notices, package contents and installation. Sign/notarize the Mac DMG.
-- [ ] Merge PR #2, tag 2.0.0, publish immutable binary/source assets and update the
+- [x] Merge PR #2, tag 2.0.0, publish immutable binary/source assets and update the
   shared CMS project. Verify downloaded bytes and record release evidence.
 
 Windows, additional features and package-manager registries remain deferred.
 
 ## Resume note
 
-Current: preparing the approved 2.0.0 migration and release above. No 2.0.0
-assets or tag have been published yet. Previous delivery evidence follows.
+Sized 2.0.0 is released at [Gamertan](https://gamertan.com/projects/sized/) and
+[Gitea](https://gitea.speelman.ca/gamertan/sized/releases/tag/v2.0.0).
+PR #2 fast-forwarded into main; annotated tag `v2.0.0` resolves to
+`9f36122e37ea3aefbd22ded08950e8858538e44b`. Public Sized includes the exact core
+`fb63e96266dcb8ffbca53b73c6c0f738ac3e827d` snapshot. The core forge remains private.
+
+Mac arm64 passed 33 tests; Linux ARM64 and native AMD64 each passed 35, including
+real mount boundaries, strict Clippy and extracted-package checks. Final source
+passes offline builds without private credentials. Gitea push/PR runs
+[1071](https://gitea.speelman.ca/gamertan/sized/actions/runs/1071) and
+[1072](https://gitea.speelman.ca/gamertan/sized/actions/runs/1072) pass.
+The Mac DMG is Developer ID signed, notarized and stapled; its Chrome-downloaded,
+quarantined copy passed Gatekeeper, installation and an actual fixture scan.
+All five public downloads match the verified release files. The shared CMS page
+is published at revision 10 and fits desktop and 320px mobile. See
+[SHIPMENT.md](SHIPMENT.md#sized-200--10-october-2026) for artifacts and limits.
+
+No approved release work remains. Next: collect ordinary-user feedback and
+older/fresh-Mac acceptance before broadening supported platforms or adding
+installers. Core changes should land upstream first, then advance the full pin
+and public snapshot deliberately. No scanner or SizeQueen rebuild is required
+for these documentation records.
+
+### Earlier project-page delivery
+
+The following record predates the completed 2.0.0 release above.
 
 The approved Sized project page and release cleanup are delivered. Source
 checkpoint `77b11a8c29b5ca3435fdd962717f8e8285abe972` is pushed on