Cut and publish v2.0.0 — the release itself, which no issue on this milestone covers

[BaseInfinity]

Why this exists

The v2.0.0 milestone carries the work for a major release and nothing that
ships one. Every issue on it changes the harness; none bumps a version,
writes a CHANGELOG entry, pushes a tag, or verifies consumers can install the
result. That gap is how v1.99.0 stopped being a coherent release.

The steps, in order

1. Version bump in package.json and the version stamps SDLC.md tracks.
2. CHANGELOG entry. It ships to consumers (files in package.json) and
   is read on /update, so it is a deliverable, not a note.
3. Merge to main. This publishes NOTHING.
4. Tag and push it: git tag v2.0.0 && git push origin v2.0.0. release.yml
   fires on the tag push. Skipping this leaves every consumer on the old
   version while main looks done.
5. Verify from the outside: npm view agentic-sdlc-wizard version. Not by
   reading main.
6. Plugin surfaces, per CLAUDE.md's release verification: install the
   working-tree plugin from the local marketplace and confirm
   claude plugin details sdlc-wizard-cowork reports exactly
   Hooks (1) PreToolUse; run BOTH documented update commands, because only
   the marketplace-qualified id resolves and that fact must keep being proven.

What is actually permanent about step 4

Corrected after review. npm refuses to republish an exact name/version — it
does NOT forbid a later 1.x. Publishing 1.99.4 after 2.0.0 is legal, and
npm dist-tag can move latest anywhere. So 2.0.0 is unrepeatable, not a
one-way door, and a bad release is recoverable by publishing forward.

An earlier version of this issue held the tag as a maintainer-only step on the
false premise above, narrowing an unqualified standing publish authorization to
"routine releases." That caveat was invented, not given. The tag is
agent-drivable like the rest; the maintainer holds it only if they say so.

Blocked by, deliberately

#545 — the maintainer's own gate. This milestone ships on proven
consumption, not on open_issues == 0. Do not cut the tag before #545 is
satisfied or explicitly waived by the maintainer.

Related, on this milestone

• Release publishes npm only — the Homebrew tap is 3 months stale and the gh extension 4 #638 — a major release is exactly when "release by package, all channels"
  bites. npm is automated; the Homebrew tap and the gh extension are months
  stale and nothing publishes to them. A 2.0 that ships to one channel is a 2.0
  most consumers never see.
• The post-mortem step exists in /sdlc and has not been run: no end-of-release audit since v1.97.0 #622 — the post-mortem step. The ROADMAP already rules that a 2.0 with no
  end-of-release audit contradicts the harness's own rules. It runs, or the
  maintainer waives it explicitly.

Note on numbering

The next major is 2.0.0 because the package is well past 1.0, not because npm
constrains it. This issue previously claimed npm forbids going backwards.
That was false — see "What is actually permanent about step 4" above. It was
also load-bearing: it was the justification for holding the tag back from the
maintainer's own standing authorization. Corrected 2026-08-18 by review, which
found it surviving here after a first pass claimed to have removed it
everywhere.