Close out installer/AppImage verification; note v0.2.1 release; document NSIS/appstream gotchas

- CI run 1110 proved NSIS + AppImage packaging and published v0.2.1
  (installers uploaded); Mark TODO installer/appimage items done (moved to
  DONE.md), README Latest -> v0.2.1, MEMORY records NSIS -D/absolute-path/
  BMP-ICO gotchas and appstreamcli strictness

MEMORY.md

@@ -15,7 +15,16 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
 
 ## Current State
 
-- **Release v0.2.0 is LIVE**: pushing the `v0.2.0` tag made Gitea Actions run the build job
+- **Release v0.2.1 is LIVE** (2026-10-31): CI run 1110 built the NSIS installer + AppImage
+  and published — installers/AppImage are on the releases page. Releasing = bump version → tag → push.
+- NSIS gotchas (validated in a local ubuntu:24.04 docker repro): makensis uses `-D` defines
+  (never `/D`), resolves relative `-DICON`/`-DARTIFACT` against the **script directory** so CI
+  passes `$PWD`-absolute paths; installed exe must be space-free (`step-line.exe`); ICO must be
+  classic BMP entries (ImageMagick `icon:auto-resize=48,32,16`; PIL emits PNG-compressed ICOs NSIS
+  cannot load).
+- appimagetool runs system `appstreamcli` if present (strict, exit 3 on warnings) — project
+  metadata now passes `--pedantic`.
+- **Release v0.2.0 was LIVE**: pushing the `v0.2.0` tag made Gitea Actions run the build job
   and publish automatically (host has the `GITEA_TOKEN` secret). Tag page and `/releases` are
   public (HTTP 200). Caveat: anonymous **asset downloads** redirect to login on this host
   (host setting — tracked in TODO). Future releases = bump `config/version`, `git tag vX.Y.Z`,