release: prepare 0.2.0-rc.1

[MrCry0]

Summary

Version bump and packaging fixes for the first beta/release-candidate build. No functional code changes to rinexfetch itself beyond what's already on main - this PR is about cutting a release, not adding a feature. Below is a full description of what 0.2.0-rc.1 actually does, end to end.

What rinexfetch does as of this release

Nav pipeline - fetches the combined multi-GNSS broadcast navigation file for a given time:

• --time latest resolves to the most recent day with a usable nav product, walking backward through final and rapid tiers (BRDC00IGS, then BRD400DLR) across up to 5 fallback days if needed; --time <ISO8601> resolves to an explicit day.
• A candidate that fails to parse, or even triggers a panic inside the RINEX parsing library (confirmed against a real malformed CDDIS file), is treated the same as "not published yet" - the next candidate is tried rather than aborting the whole run.
• --systems filters the output to a chosen subset of gps, glonass, galileo, beidou, qzss, sbas (or all).
• --rinex-version 3 or 4 selects the output format, converting from the source version where needed. Downconverting a RINEX-4-native source to RINEX 3 is detected and reported with a clear error when the underlying library can't represent it, rather than writing a broken file.

Obs pipeline - optionally fetches per-station observation files for an explicit --stations list (modern 9-character IGS IDs only):

• Each station is fetched, decompressed (including Hatanaka/CRINEX), filtered, and converted independently.
• A bad station ID, an unknown/unpublished station, or any other per-station failure is isolated - it's reported but never aborts the other stations or the nav fetch.

Authentication - NASA Earthdata Login (URS) bearer token, attached as a header (no username/password exchange):

• Interactive prompt (hidden input) or OS-native keyring (Secret Service/Keychain/Credential Manager) as credential sources.
• The keyring backend asks explicit consent before saving a freshly entered token, and only asks once - an already-stored token is reused silently on later runs.
• If no OS keyring backend is reachable (common on headless/server Linux without a Secret Service daemon), a clear, actionable error is shown instead of an opaque one.

Reliability - structured, specific error types throughout (auth / not-yet-published / network / unknown-station / parse-format), download integrity via gzip's CRC32 trailer, and the fallback/isolation behavior described above.

Packaging - built and tested for all three major desktop platforms: .deb (Debian/Ubuntu), .rpm (Fedora), .pkg (macOS, arm64 and x86_64), .msi (Windows x86_64), plus a plain tarball/zip per platform. CI builds and tests on Linux, macOS, and Windows on every push/PR.

Release-specific changes in this PR

• Cargo.toml version bumped to 0.2.0-rc.1.
• A SemVer pre-release identifier needs different handling per package format, confirmed by actually running each packaging tool locally:
  • cargo-wix (Windows .msi) requires the pre-release identifier to be numeric or dot-separated (rc.1, not rc1) to derive a valid Windows ProductVersion.
  • cargo-deb (Debian .deb) auto-converts "-" to Debian's own "~" pre-release marker; no changes needed.
  • cargo-generate-rpm (Fedora .rpm) hard-rejects "-" in the version entirely (RPM reserves it as the name-version-release separator). Added an explicit package.metadata.generate-rpm.version override using RPM's "~" convention, commented in both places to keep it in sync on future releases.
• release.yml now marks a tag with a pre-release identifier as a GitHub pre-release rather than "Latest".
• README status section and installation instructions updated to reflect the beta milestone.

Test plan

• cargo build / cargo test / cargo fmt --check / cargo clippy --all-targets -- -D warnings all pass
• Built .deb and .rpm packages locally with the new version string to confirm the packaging fixes work in practice, not just in theory
• All 33 unit tests and 9 live-archive tests pass