Othala v0.2.0 — the convergence release (PRIVATE; public flip deferred to v0.3.0)

Runtime manifest model, rename to Othala, OAuth2 challenge surface converged
(dual-listener portal, /oauth2 flow URLs, Authorization: Bearer recovery-gate),
default-group tile gating, functional contact form. Config-only deploy shape;
459 unit tests, astro check/build clean, smoke green on the carmine QEMU runner.

This tag enables the dag.dunn.dev deploy (iac pins it; CI publishes othala +
othala/ldap-bridge images). Repo stays PRIVATE — public flip is a deliberate
v0.3.0 act.