fix: propagate post-release verification status

[shenjiecode]

Patch release v0.2.1

The immutable v0.2.0 release and tag were created correctly. Post-publication verification successfully proved that the SemVer tag peeled to main and that v0.1.0 was unchanged, but the final report incorrectly kept AC-CLOSURE-RELEASE-01 blocked because the nested live-only report intentionally has local.status=not_run.

This patch separates the two correct concepts:

• overall release.status still requires both local and live to pass;
• AC-CLOSURE-RELEASE-01 requires live verification plus a validated published tag, and does not require a local run inside the live subcommand.

A live-only post-publication report therefore remains release.status=blocked while correctly recording the publication AC as passed. The enclosing release command carries that fact into its final report.

Also bumps the patch version to 0.2.1 and explicitly preserves v0.1.0 and v0.2.0 as immutable tags.

Verification

• actual v0.2.0 post-publication check: live passed; publication AC passed
• 131/131 tests
• format, lint, typecheck, build, E2E
• independent review: no blocking issue