feat: emit verifiable rollback evidence

[aliengineering-byte]

Outcome

AgentTX 0.2.0 adds a versioned, offline-verifiable rollback receipt and evidence contract while preserving the existing transaction CLI and programmatic exports. Receipts bind transaction identity, before/after workspace state, canonical patch metadata, rollback outcome, and verifier status; tampering and conflicting output fail closed.

Scope boundary

AgentTX is a Git-worktree transaction helper and verifier. It is not an OS sandbox and cannot roll back external side effects. Dirty, ignored, untracked, interrupted-command, native-Git, and conflict limitations remain documented.

Validation

• style/lint: pass
• TypeScript typecheck/build: pass
• 48 tests passed, 3 intentionally skipped
• PR CI: 12/12 green across Node 20/22/24 and Ubuntu/macOS/Windows
• package secret scan and local Markdown links: pass
• release tarball pack/install/version/shebang: pass
• rollback scenario: pass
• commit preserves unrelated user work: pass
• concurrent conflict refusal: pass
• package SHA-256 observed locally: 809fd289573e14c29d4b629049eb414a6c30d5e1f9a044fd7ed63c91323b9408

Publication is separate from this PR. npm agenttx remains at 0.1.0; registry owner ali110v is visible publicly, but this environment has no npm authentication and whoami returns 401.