docs(changelog): 0.2.0 release notes

[oratis]

Changelog entry for 0.2.0, covering the 31-PR Codex alignment stack (#180–#210) plus the dependency work (#211–#214, #155, #177–#179).

Version choice: minor, pre-1.0. There are breaking changes — RunAgentOptions.mode is now required, and the desktop renderer's native mutation/credential commands are gone — but pre-1.0 convention puts those in a minor bump.

The entry leads with security rather than features, because that's what this release actually is: the central tool gate could be skipped entirely whenever mode was omitted (#181), and the desktop renderer held provider credentials (#192).

Upgrade notes call out the two things a user could otherwise be blindsided by:

• the ~6.7 MB → ~115 MB desktop size increase from the bundled Node sidecar
• the plugin capability RPC is not an OS boundary — earlier docs overstated this

Release readiness

I ran the release workflow's validate job locally against this commit. All green:

step	result
pnpm typecheck	pass
pnpm lint (--max-warnings=0)	pass
pnpm format:check	pass
pnpm test	1048 pass, 16 skipped
pnpm docs:check	pass
pnpm release:check	pass
desktop Playwright journey	4/4 pass

Release gate measurements against budget:

artifact	measured	budget
extension.cjs	31,814 B	64 KiB
app-server.cjs	599,825 B	768 KiB
VSIX	185,305 B	256 KiB
cold initialize	~53 ms	5 s
workspace diff	~278 ms	10 s
thin-client scan	53 files, 0 violations	—

⚠️ Tagging is blocked on repository secrets

v* tags trigger release.yml, but this repository currently has no Actions secrets configured (gh api repos/oratis/deepcode/actions/secrets returns an empty list). Six are required:

secret	used by	consequence if missing
CSC_LINK	Import Developer ID certificate	build-mac fails
CSC_KEY_PASSWORD	Import Developer ID certificate	build-mac fails
APPLE_ID	Store notarization credentials	build-mac fails
APPLE_APP_SPECIFIC_PASSWORD	Store notarization credentials	build-mac fails
APPLE_TEAM_ID	Store notarization credentials	build-mac fails
NPM_TOKEN	Publish deepcode-cli	npm publish fails

The signing and notarization steps are unconditional — there's no if: guard — so build-mac would fail outright. And because #208 correctly made publish-cli and github-release both needs: build-mac, the effect is that nothing would be published: no npm release, no GitHub Release, no DMG. A tag pushed today produces a red run and a tag that then has to be deleted.

That ordering is working as designed — it's exactly the partial-release hazard #208 set out to prevent.

These are credentials, so they need to be added by a maintainer. Once they're in place:

git tag -a v0.2.0 -m "DeepCode 0.2.0" && git push origin v0.2.0

🤖 Generated with Claude Code