chore: open 2.0.1 development line and regenerate social card

- gradle.properties 2.0.0-SNAPSHOT -> 2.0.1-SNAPSHOT; browser SDK package.json
  2.0.0 -> 2.0.1-SNAPSHOT (committed dev version mirrors gradle per RELEASE.md;
  the publish step pins the concrete version). New @SInCE tags now target 2.0.1.
- Update the current-development-line references in CLAUDE.md, README.md, and
  docs/stability.md to 2.0.1-SNAPSHOT, and add 2.0 to the shipped-releases list.
- Regenerate site/og-image.png from og-image.svg (now shows v2.0.0); rendered
  1200x630 with Inkscape, Georgia present so it matches the design.

Existing @SInCE 2.0.0 tags are unchanged (that API shipped in 2.0.0).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: wolpert

CLAUDE.md

@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## What this is
 
-pk-auth is a **passkeys-first authentication library set for the JVM**, published to Maven Central under `com.codeheadsystems`. All modules share one version (`gradle.properties` → currently `2.0.0-SNAPSHOT`). It is *not* an identity provider: it owns passkeys/credentials, never users — the host maps users via the `UserLookup` SPI.
+pk-auth is a **passkeys-first authentication library set for the JVM**, published to Maven Central under `com.codeheadsystems`. All modules share one version (`gradle.properties` → currently `2.0.1-SNAPSHOT`). It is *not* an identity provider: it owns passkeys/credentials, never users — the host maps users via the `UserLookup` SPI.
 
 The canonical architecture reference is [`DESIGN.md`](./DESIGN.md); per-decision rationale lives in [`docs/adr/`](./docs/adr/) (Nygard format, numbered). Read the relevant ADR before changing cross-module behavior.
 

README.md

@@ -151,7 +151,7 @@ tests and Playwright end-to-end suites:
 ## Status
 
 1.0.0 cut the stable baseline; the current development line is
-**2.0.0-SNAPSHOT** (see `gradle.properties` for the authoritative
+**2.0.1-SNAPSHOT** (see `gradle.properties` for the authoritative
 version). The 1.1 line added per-audience JWT TTLs, the
 `AccessTokenStore` (stateful access tokens), the
 `UserDeletionService` fan-out, and the `pk-auth-refresh-tokens`

clients/passkeys-browser/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pk-auth/passkeys-browser",
-  "version": "2.0.0",
+  "version": "2.0.1-SNAPSHOT",
   "description": "pk-auth browser SDK: WebAuthn ceremonies + admin operations against the pk-auth wire contract.",
   "license": "MIT",
   "author": "Ned Wolpert",

docs/stability.md

@@ -3,8 +3,8 @@
 ## Current status: 2.x
 
 pk-auth is **post-1.0** as of the `v1.0.0` tag. The current development line is
-**2.0.0-SNAPSHOT** (`gradle.properties` is authoritative); the 1.1, 1.2, and
-1.3 releases have shipped. See [`CHANGELOG.md`](../CHANGELOG.md) for the
+**2.0.1-SNAPSHOT** (`gradle.properties` is authoritative); the 1.1, 1.2, 1.3, and
+2.0 releases have shipped. See [`CHANGELOG.md`](../CHANGELOG.md) for the
 per-release delta.
 
 Post-1.0, pk-auth follows [Semantic Versioning](https://semver.org/):

gradle.properties

@@ -21,4 +21,4 @@ org.gradle.jvmargs=-Xmx2g \
 
 # Project identity
 group=com.codeheadsystems
-version=2.0.0-SNAPSHOT
+version=2.0.1-SNAPSHOT