Release 0.2.0: graduation merge race fix + VITE_APP_NAME + versioning infrastructure

- Fix §13.3 step 4 race against Gitea's async mergeability
  computation: gitea.wait_for_mergeable polls the mergeable
  field before calling merge, and bot._merge_with_retry rides
  out the transient 'Please try again later' response.
- Frontend now requires VITE_APP_NAME at build time
  (frontend/vite.config.js fails the build if unset). Header
  brand, landing H1, and browser title read the deployment's
  configured name.
- Establish framework versioning: VERSION (canonical) +
  frontend/package.json#version mirror; CHANGELOG.md as the
  release log with RFC 2119 / 8174 normative-language
  upgrade-steps; SPEC.md §20 as the binding policy; CLAUDE.md
  capturing the separation-of-concerns rule; docs/DEPLOYMENTS.md
  as the downstream operating manual; docs/QUICKSTART-VISION.md
  staking the future one-command-deploy capability.
- Surgical fix to SPEC.md opening so the spec no longer asserts
  OHM is the corpus the framework produces.
- SPEC.md §19.2 gains the 'Deployment-supplied subject framing'
  candidate that drives the 0.3.0 release.

frontend/vite.config.js

@@ -1,15 +1,46 @@
-import { defineConfig } from 'vite'
+import { defineConfig, loadEnv } from 'vite'
 import react from '@vitejs/plugin-react'
 
 // In dev, the frontend runs on Vite's port and proxies the API
 // (and /auth/*, /api/webhooks/*) to the FastAPI process.
-export default defineConfig({
-  plugins: [react()],
-  server: {
-    port: 5173,
-    proxy: {
-      '/api': 'http://localhost:8000',
-      '/auth': 'http://localhost:8000',
+//
+// VITE_APP_NAME is the user-visible name of this deployment — used in
+// the browser tab title, the header brand, and the landing page H1.
+// The framework intentionally ships no default: every deployment must
+// supply its own name via `frontend/.env` so a fresh build never ships
+// the wrong brand. See `frontend/.env.example`.
+export default defineConfig(({ mode }) => {
+  const env = loadEnv(mode, process.cwd(), '')
+  const appName = env.VITE_APP_NAME
+
+  if (!appName || !appName.trim()) {
+    throw new Error(
+      'VITE_APP_NAME is required but not set. Copy frontend/.env.example to ' +
+      'frontend/.env and set VITE_APP_NAME=... before building. The framework ' +
+      'ships no default on purpose — each deployment names itself.'
+    )
+  }
+
+  return {
+    plugins: [
+      react(),
+      // Build-time HTML token substitution: `%VITE_APP_NAME%` inside
+      // `index.html` becomes the configured name. Vite already does this
+      // for env vars referenced as `%VITE_*%` in HTML, but we wire it
+      // explicitly so the failure mode (token left in title) is loud.
+      {
+        name: 'inject-app-name',
+        transformIndexHtml(html) {
+          return html.replace(/%VITE_APP_NAME%/g, appName)
+        },
+      },
+    ],
+    server: {
+      port: 5173,
+      proxy: {
+        '/api': 'http://localhost:8000',
+        '/auth': 'http://localhost:8000',
+      },
     },
-  },
+  }
 })