release: 0.2.2

[Nik7A]

Cuts 0.2.2 over the four fixes now on main (#11, #12, #13, #14). Version bump + CHANGELOG only — no code.

What ships

Rotation destroyed the previous key's records	manifest.pubkeys is append-only. Verifier resolves rotated-away keys from the manifest alone.
__version__ two releases stale	Derived from dist metadata; the number lives once.
Sink promised cross-process serialisation	Promise now names the process boundary.
is_control_flow_signal was private	Public, with the underscore name kept as an alias until 0.3.

All four were reported by a host putting the library into real use, not by reading the code. One had already destroyed evidence — 330 records signed with a key that exists nowhere.

Compatibility

• No change to the signature form or the chain. Records from 0.1.x, 0.2.0 and 0.2.1 verify unchanged.
• Existing manifests stay readable: pubkeys is additive and schema_version is untouched, because from_dict rejects any version but its own and a bump would make every manifest in the field unreadable.
• _is_control_flow_signal still resolves, for hosts pinning >=0.2,<0.3.

Worth noting

__init__.py needed no edit for this bump. 0.2.2 is the first release where __version__ derives from the packaging config instead of being a literal someone has to remember — it reported 0.2.2 the moment pyproject.toml did. That is #11 paying for itself one release after landing.

After merge

git tag -s v0.2.2 -m "0.2.2" <merge commit> && git push origin v0.2.2