chore(main): release 0.2.0

[github-actions]

🤖 I have created a release beep boop

0.2.0 (2026-07-31)

Features

• add dynamic assume role support via scope-configurations provider (085964a)
• add requirements module with IAM policies for Lambda scope operations (d9ff61b)
• assume-role: resolve role ARN from nullplatform IAM provider by selector (779eef9)
• dynamic assume-role support, configurable placeholder image & install tofu consolidation (847e5fd)
• iam: make Lambda execution-role prefix configurable (23e2515)
• lambda: optional public ALB in requirements module (#30) (fae610e)
• lambda: update ZIP runtime list and default to nodejs22.x (#31) (d5982f0)
• placeholder: make placeholder image configurable via PLACEHOLDER_IMAGE_URI_DEFAULT (bd26af4)
• workflows: assume IAM role via dedicated first step in every workflow (5109c0e)

Bug Fixes

• correct nullplatform provider version constraint in specs/tofu (d49d2b9)
• deploy: add missing diagnose.yaml workflow for diagnose-deployment action (c04e9cc)
• deploy: ensure Lambda pull policy on the image's ECR repo before update (2dc0a3e)
• iam: add modern CloudWatch Logs tagging actions to lambda requirements policy (b9e41d3)
• iam: prefix lambda execution role with np-lambda- to match requirements policy (97121e4)
• read TOFU_STATE_BUCKET from .provider.aws_state_bucket as fallback (3f89288)
• remove automatic arch suffix from placeholder image URI (fc8bc76)
• specs/tofu: bump aws provider constraint to ~> 6.47.0 (6752bee)
• specs: derive asset_type from deployment_type (fa34054)
• surface sts:AssumeRole errors to stdout for visibility in NP logs (33842ec)
• tofu: surface tofu apply stderr to stdout for visibility in NP logs (684d9f7)
• use exact PLACEHOLDER_IMAGE_URI when explicitly set, skip arch suffix (14d3ad5)

---

This PR was generated with Release Please. See documentation.

[github-actions]

🤖 Created releases:

• v0.2.0

🌻