Fix release provenance for 0.2.1

[Zk-nd3r]

What changed

• bump @frontiercompute/zap1 to 0.2.1 without verifier-semantic changes
• add fail-closed repository, invocation-root, annotated-tag, commit, workflow-ref, and clean-tree release gates
• publish only from the pinned GitHub Actions OIDC workflow and verify npm gitHead, integrity, shasum, and provenance after publication
• keep the packed clean-install/browser matrix version-independent

Root cause

Version 0.2.0 was published while npm was invoked from an unrelated parent Git repository. Its package bytes matched the tagged source, but npm recorded that parent repository commit as gitHead.

Validation

• 23/23 verifier tests
• release-gate negative fixtures for parent invocation, lightweight tag, and dirty tree
• packed clean-install and Chromium matrix
• npm audit: 0 findings
• git diff --check