chore(release): prepare v1.0.0-alpha.2

[thinmintdev]

Summary

Prepare the non-publishing v1.0.0-alpha.2 integration candidate from the reviewed Preview hardening and MCP security baseline (main at d9c2e1e8).

This changes exactly the five canonical version files:

• manifest.json: 1.0.0-alpha.2
• pyproject.toml: 1.0.0-alpha.2
• ui/package.json: 1.0.0-alpha.2
• ui/package-lock.json: 1.0.0-alpha.2
• uv.lock: PEP 440 1.0.0a2

No runtime, workflow, release-policy, installer, updater, or documentation source is changed.

Verification

• python scripts/set-version.py --check 1.0.0-alpha.2: valid; no files modified
• bash scripts/release-check.sh --local --channel preview --tag v1.0.0-alpha.2: passed
• Python: 7388 passed, 15 skipped, 1 deselected, 1 xfailed
• UI typecheck: passed
• UI unit: 4 passed
• UI production build: passed
• Chromium: 470 passed, 17 skipped
• Ruff: passed
• all seven toolbox images are digest-pinned
• base includes mcp==1.28.1, clearing the three high-severity MCP SDK advisories found during candidate review
• no remote v1.0.0-alpha.2 tag, GitHub Release, or PyPI hal0ai==1.0.0a2 collision
• candidate tree is byte-identical to the independently reviewed pre-merge candidate tree apart from Git history

Deliberately not performed

This PR does not create or push a tag, dispatch the release workflow, publish GitHub/PyPI assets, deploy hal0-web, or advance a channel pointer.

The candidate remains not release-authorized until:

1. a fresh coherent non-local tier-γ report passes
2. production hal0-web serves authenticated paired Preview manifest bytes
3. an explicitly authorized real OIDC/Cosign publication run completes and authorize-pointer evidence is reviewed
4. the Preview pointer is separately authorized and live install/update/rollback/stable-isolation gates pass

[thinmintdev]

CI is green, but merge is intentionally held: GitHub surfaced three high-severity MCP Python SDK advisories on the current mcp==1.27.0 lock. A minimal mcp==1.28.1 security patch is being validated separately. After that lands on main, this version-only branch will be updated and its release rehearsal rerun before merge.

[thinmintdev]

Security prerequisite #1348 has merged as d9c2e1e8. This branch was regenerated from that exact main using scripts/set-version.py, producing a fresh five-file-only version commit 08b06df6; no conflict resolution or dependency downgrade was carried forward. Fresh CI and final release rehearsal are running.