Complete PRIORITY: release v0.2.0 published by CI; document download sign-in caveat

- Tag v0.2.0 pushed; Gitea Actions build job exported Linux/Windows/macOS
  and published the release via the host's GITEA_TOKEN secret (CI run 1095:
  'Release live: .../releases/tag/v0.2.0', Job succeeded)
- Verified tag page + /releases are public (HTTP 200); anonymous asset
  downloads require sign-in on the host (tracked as host-config follow-up)
- TODO cleaned per AGENTS.md; PRIORITY section moved to DONE.md
- README Downloads notes v0.2.0 live + sign-in caveat; MEMORY updated

README.md

@@ -26,9 +26,13 @@ The central design goal is simple:
 
 **All releases:** <https://git.allucanget.biz/zwitschi/security-game/releases>
 
-> Releases are built automatically by Gitea Actions when a `vX.Y.Z` tag is
-> pushed (see [`docs/RELEASING.md`](docs/RELEASING.md)). Manual builds are
-> produced with `./tools/build_releases.sh`.
+> **Latest: v0.2.0** (2026-10-31) — built and published by Gitea Actions from the
+> `v0.2.0` tag. Releases are built automatically when a `vX.Y.Z` tag is pushed
+> (see [`docs/RELEASING.md`](docs/RELEASING.md)); manual builds use
+> `./tools/build_releases.sh`.
+>
+> Note: on this host, downloading release files currently requires sign-in;
+> the page and tag URLs are public.
 >
 > macOS builds are unsigned: right-click → Open, or clear the quarantine with
 > `xattr -dr com.apple.quarantine step-line-macos.zip`. Build instructions and