docs: record qualified codec 0.2.0 publication

.github/ISSUE_SPECS/010-move-the-codec-to-stable-effect-4-0-x.md

@@ -27,3 +27,7 @@ Base: origin/main `10abab98191b878482a02c0d8e9a2572c8eb0958` (codec 0.1.1). Bran
 ## Release contract and blockers
 
 Release follows `.github/RELEASING.md`: merge a reviewed, green PR; run `npm-publish.yml` on `main` with `mode=publish`, the exact 40-character merge SHA, and `expected_version=0.2.0`; create the `v0.2.0` release/tag at that commit; record the run URL, registry integrity, and decoder hash here and in `.github/RELEASE_EVIDENCE/010/registry-release.json`. Blockers: the adapter PR installs this codec from the throwaway branch `effect-4.0.4-ci-dist` and must be flipped to the published 0.2.0 after release; delete that branch afterwards. Publication has not been performed.
+
+## Published release
+
+Codec 0.2.0 was merged in PR #9 at `56383ab56c2a389a6856b27d8207695f6153c0fe` and published through trusted publishing: https://github.com/misofm/codec/actions/runs/38429325908 . Its qualification and `npm publish` (signed provenance) succeeded; the job then failed its post-publish convergence check only because the registry took more than two minutes to list the version, so its registry-consumer job was skipped. A `mode=verify` dispatch at the same commit, https://github.com/misofm/codec/actions/runs/38430320099 , passed qualification, registry comparison, and the full registry-consumer matrix against the published tarball (read-only; it does not itself claim an OIDC publication). The `v0.2.0` annotated tag and release point to that revision: https://github.com/misofm/codec/releases/tag/v0.2.0 . Registry integrity, tarball SHA-256, and decoder hash are recorded in `.github/RELEASE_EVIDENCE/010/registry-release.json`; the decoder asset is unchanged (`70caf381…`). The adapter PR (https://github.com/misofm/engine-web-adapter/pull/130) moves to the published package; the throwaway `effect-4.0.4-ci-dist` branch is retained until that lands.

.github/RELEASE_EVIDENCE/010/registry-release.json

@@ -0,0 +1,12 @@
+{
+  "version": "0.2.0",
+  "dist.integrity": "sha512-nbhiEKPBElcwB4sc57McQLWh/1hdXLgPH2W2Dz2qU3luxiiNXtCwbCU/BunGuTrRNVudnrJod8rITv5ksUmqGA==",
+  "tarballSha256": "dcc058497b59187528703b4b2dba9b2ea09a4d6604754bbf23a4c6502c88e999",
+  "workflow": "https://github.com/misofm/codec/actions/runs/38429325908",
+  "workflowNote": "mode=publish: qualify succeeded and `npm publish` succeeded with signed provenance; the job's post-publish convergence check failed only because the registry took more than two minutes to list the version, so registry-consumer was skipped.",
+  "verifyWorkflow": "https://github.com/misofm/codec/actions/runs/38430320099",
+  "verifyWorkflowNote": "mode=verify at the same commit: qualify, publish-or-compare and registry-consumer all succeeded against the published tarball; read-only, so it does not itself claim an OIDC publication.",
+  "sourceRevision": "56383ab56c2a389a6856b27d8207695f6153c0fe",
+  "release": "https://github.com/misofm/codec/releases/tag/v0.2.0",
+  "decoderSha256": "70caf38185675dff89498e89f98171d49ec6f143a56c6895088d93c35e2018cd"
+}