Prepare Starmap v0.2.0 with refreshed catalog

[jackspirou]

What changed

• Refresh the embedded catalog from current provider and models.dev observations, including Google Vertex and Moonshot AI Kimi K3.
• Preserve reviewed author/model identity links and quarantine unreviewed live records.
• Render the complete human-editable Boolean capability surface without letting projection defaults become false source authority.
• Normalize provider pricing units and dynamic JSON evidence deterministically.
• Fix structured CLI output, first-run workspace creation, model search routing, CORS activation, and update deadlines.
• Prepare the changelog for the prelaunch-breaking v0.2.0 application release.

Why

Starmap needs a fresh, immutable, human-readable catalog and predictable library, CLI, and server behavior before release as the catalog core for Starport. The source pipeline must retain canonical authorship, prefer authoritative provider observations, and remain deterministic across regeneration and restart.

Validation

Completed locally:

• Catalog generation integrity checks.
• Embedded catalog freshness, size, model, and provider budget.
• Pure-Go external library, store, server, remote subscriber, S3, and CLI compositions with CGO_ENABLED=0.
• Focused embedded, bootstrap, catalog, and artifact tests.
• GoReleaser 2.17.0 configuration validation.
• Installed CLI smoke with 136 reviewed Google Vertex offerings.
• git diff --check.

The complete make verify gate is running on the exact release tree. Required hosted Verification Gate and Security & Reliability checks must pass before merge.

Release

After protected merge to main, tag the exact merge commit as v0.2.0. The release workflow will build cgo-disabled binaries and container images, publish signed checksums and SBOMs, attach GitHub provenance, verify immutable downloaded assets, and verify the AgentStation Homebrew cask.

[jackspirou]

Release-gate correction on exact head bc3a189c:

• The first local full verification exposed repeated decoding/verification of the immutable 8.1 MB embedded YAML generation and a one-minute projection deadline that was too narrow for race-instrumented full-workspace saves.
• The process now loads and verifies one immutable bootstrap catalog per process and safely shares it across clients/goroutines; mutable builders remain separate.
• Full human-readable capability fields are retained.
• The bounded projection/repair deadline is now three minutes.
• Exact failed race cases pass in 100.493s.
• The complete root race package passes in 460.913s, below the 20m package gate.

Both required hosted checks must rerun and pass on bc3a189c before merge.