chore(release): delete the committed 0.2.0 tarball, and ignore packed output

[AetherAI3]

aether-agents-0.2.0.tgz — 576 KB — sits at the repository root. It was committed on 2026-08-19 in #83, and six pull requests have merged since: #84, #85, #86, #87, #88 and #89. The file no longer contains the code its own name asserts it does.

Nothing automated reads it. It is not in the files allowlist so npm publish never includes it, and release.yml runs npm pack against the tagged commit rather than reusing anything from the tree.

The exposure is a person. v0.2.0 is prepared and unpublished; a repository root holding a file called aether-agents-0.2.0.tgz is an invitation to publish that by hand and ship a build missing six merged changes. Found while establishing what "v0.2.0 is prepared" actually means for the release closure — the answer is that main is at 0.2.0, CI and CodeQL are green at ac642363, no tag or GitHub release exists, npm still serves 0.1.0, and the npm-production environment and NPM_TOKEN do not exist, so the publish step fails closed.

*.tgz is ignored so the next one cannot land the same way.

[AetherAI3]

Superseded by #90, which already deletes aether-agents-0.2.0.tgz as part of a broader and better-aimed change — the README and install.sh also point at a version npm does not serve, which is the larger half of the same problem.

I opened this without re-listing the open pull requests; #90 and #91 landed in the window between my last check and this branch. That is the second time today. Closing in favour of #90.

The finding is recorded either way: the tarball was committed on 2026-08-19 in #83, and #84, #85, #86, #87, #88 and #89 have merged since, so the file no longer contains the code its name asserts. Nothing automated reads it — it is outside the files allowlist and release.yml packs a fresh one from the tag — so the exposure is a person publishing it by hand while v0.2.0 is prepared and unpublished.