Release v0.2.2-beta.2 runtime candidate

[keegreil]

Summary

• combines the independently retested RT-041/042 fixes with the RT-076 completeness patch
• carries forward post-critical resource, SSRF, bundle-fetch, stale-parent, payout, and reorg hardening
• pins refreshed Node/.NET 10 base image manifests and enables image SBOM/provenance
• updates locked dependencies; local image scan is clean at HIGH/CRITICAL

Validation

• 233/233 .NET tests
• 21/21 dashboard tests
• source secret scan passed
• NuGet and npm advisory scans clean
• local multi-stage Docker build passed
• Trivy 0.74 image scan: 0 HIGH/CRITICAL

This is an early-beta release candidate, not a stable release.