Release 0.2.0 - #54

Brings in the upstream review fixes (lllamnyp/cozyplane#52-#54): kpr's
cilium.io RBAC wildcard is dropped outright — the wired cells watch
only Services/EndpointSlices and node-local Pods/Namespaces, proven on
a cluster serving no cilium.io group at all; controller leader
election is on with its leases Role, so raising replicas can no longer
run uncoordinated writers; the agent's per-VPC metrics are
authenticated (TokenReview/SubjectAccessReview, secure by default,
fail-closed) and bound to the node's primary address — the values file
documents that an existing anonymous scrape gets 401 until the shipped
cozyplane-metrics-reader ClusterRole is bound to the monitoring
ServiceAccount; and the chart comments that shipped inside rendered
manifests are trimmed to mechanism statements with doc pointers. The
cozyplane image pin moves to the build carrying the agent changes; the
kpr binary is unchanged, so its pin stays.

Assisted-by: LLM
Signed-off-by: Timofei Larkin <[email protected]>