chore(release): prepare v0.3.2

[davidahmann]

Outcome

Prepares Mill v0.3.2 for the existing attended public-alpha release path. The patch carries the already-merged integration-adaptation evidence and replaces stale release identities in user and operator documentation.

Changes

• Advance the package and CLI identity to 0.3.2.
• Add the v0.3.2 public-alpha release record and attended release authority.
• Update the README install command and positioning to state the local-first, repository-native workflow and explicit delivery approval.
• Make AGENTS and release settings describe the invariant exact-tag process, with current distribution facts held in the release record and provider readback.
• Update the delivery plan and changelog for the landed integration-adaptation increment.

Acceptance and scenarios

• R032-01 through R032-03: public docs, package identity, and exact-tag policy are current.
• R032-04: native check and exact-candidate audit pass; the independent complete-diff review found only a standalone P2, which the standing instruction excludes from this release.
• R032-05: remains gated on the immutable tag, independent candidate, protected OIDC publication, and provider readback after this PR is green and merged.

Validation

• npm test -- test/version.test.ts test/release-workflow.test.ts test/audit.test.ts test/schemas.test.ts
• npm run check (36 files, 306 tests, coverage and package lifecycle canary)
• node dist/cli.js --json --cwd . audit bound to ba46b9376a119c0f52bd522534cbb58ddeb048bc / c486696648e9927a206933507f4257ceefa0c529
• Read-only exact-diff Codex review against origin/main

Risk, authority, and residual limitations

The exact v0.3.2 release authority is product/release-v0.3.2.md. It authorizes only this tag, its matching protected npm-environment rule, preserved artifact, normal GitHub Release, and npm alpha/latest promotion. It retains the reviewer, selected-tag policy, independent verification, and public-alpha limits.

Assistance disclosure

• Agent-assisted work is disclosed where applicable.
• Commits include DCO sign-off.
• No credentials or private execution evidence are included.