feat: publish Tend v0.2 preview source

Publish the reviewed allowlisted snapshot whose exact binary completed maintenance deployment, rollback, and reactivation exercises for Gamertan and Sandwich Hime.

Private-Source-Commit: 4d7094c8b7c61991bfb67b11fc1558724c874eb2

Private-Source-Tree: 54a2f74804f7acddf3755d7d4da5b97f5fc28381

AI-Assistance: OpenAI Codex assisted implementation, testing, security review, and release verification.
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

README.md

@@ -5,7 +5,7 @@ Linux, systemd, and Caddy. It packages a clean pushed commit, records exact
 build provenance, activates a health-checked candidate, and keeps rollback
 state explicit.
 
-The first preview deliberately supports two quiet deployment shapes:
+The v0.2 development line supports two quiet deployment shapes:
 
 - Caddy-switched blue/green services.
 - A singleton service with an isolated transient candidate check.
@@ -17,21 +17,43 @@ shell hooks. Application-specific data activation remains application-specific.
 
 ```text
 tend check    --config tend.json
-tend package  --config tend.json --version v0.1.0-preview.2 --out dist
-tend deploy   --config /etc/example/tend.json --artifact FILE --sha256 HEX --approve-sha256 HEX
-tend status   --config /etc/example/tend.json
-tend rollback --config /etc/example/tend.json
-tend prune    --config /etc/example/tend.json --keep 3 [--apply]
+tend package  --config tend.json --version v0.2.0-preview.1 --out dist
+tend push     --target tend-deploy@host --known-hosts FILE --service NAME --artifact FILE --sha256 HEX --approve-sha256 HEX
+tend receive  --policy /etc/tend/receive-policy.json
+tend check-server --policy /etc/tend/receive-policy.json
+tend deploy   --config /etc/tend/services/example-site.json --artifact FILE --sha256 HEX --approve-sha256 HEX
+tend status   --config /etc/tend/services/example-site.json
+tend rollback --config /etc/tend/services/example-site.json
+tend prune    --config /etc/tend/services/example-site.json --keep 3 [--apply]
 ```
 
-`deploy`, `rollback`, and applied pruning are target-host operations. Transfer
-credentials and production configuration stay outside source repositories.
-Dry-run and digest approval are intentional friction.
+`push` transfers one approved artifact through a pinned OpenSSH connection. A
+forced, no-shell receiver maps the service name to one root-owned configuration;
+it accepts no remote path, environment value, URL, or shell fragment. Production
+hosts receive binaries and evidence, never source or Go dependencies.
 
-The first public preview has completed maintenance releases and explicit
-rollback/reactivation for both Gamertan and the Sandwich Hime website using one
-reviewed Tend candidate. See the dated
+Schema 2 keeps all services under `/etc/tend/services/`, references a distinct
+root-owned `0600` environment file for each service, and serializes activation
+through `/run/lock/tend-deploy.lock`. Builds and transfers remain parallel;
+only the short Caddy/service activation phase is host-wide. Tend is still a
+single command, not a daemon.
+
+Dry-run and digest approval are intentional friction. See the
+[schema-2 migration guide](docs/SCHEMA_V2_MIGRATION.md) and the
+[two-service walkthrough](docs/WALKTHROUGH.md).
+
+Run `./scripts/verify.sh` on Linux. That required release lane exercises tests,
+the race detector, vet, deterministic builds, schema-2 examples, and the
+dependency-free module graph. Tend supports Linux hosts with systemd and Caddy;
+WSL may be used as a Linux development environment, but native Windows is not a
+supported execution, deployment, or release-gate platform.
+
+The v0.1 public preview and the restricted v0.2 implementation candidate each
+completed maintenance releases and explicit rollback/reactivation for both
+Gamertan and the Sandwich Hime website using one reviewed candidate. See the dated
 [dogfood evidence](docs/DOGFOOD_EVIDENCE.md) for exact scope and limitations.
+The v0.2 preview will not be tagged until one identical binary has deployed and
+rolled back both services through the restricted transport.
 The canonical public repository begins with a sanitized root snapshot rather
 than the private development history.