chore(release): 2.0.1

Same-day hotfix on 2.0.0, nothing user-facing. It exists because the 2.0.0
archive was built before the MessagePack lift, and because the fixed release
workflow needs a tag to prove itself on -- 2.0.0 cannot, since Gitea reads the
workflow from the tagged tree and that tree still holds the broken version.

Not force-moving the 2.0.0 tag: its release object exists with the archive
attached, and someone may already have pulled it.

docs/CHANGELOG.md

@@ -11,6 +11,32 @@ releases as an overview and links to the release pages for details.
 
 ---
 
+## [2.0.1] — 2026-08-19
+
+A same-day hotfix on 2.0.0 with nothing user-facing in it.
+
+### Changed
+
+- MessagePack from 3.1.4 to 3.1.7. The range in the csproj already allowed it;
+  NuGet resolves the lower bound of a range and so does trivy, so the floor is
+  the version that actually ships. The advisories cover recursion depth in
+  `MessagePackReader.Skip` and a fault in LZ4 decompression — both need crafted
+  input, and this plugin serialises its own payloads into a local database and
+  reads its own bytes back. Practical exposure requires write access to that
+  file. Lifted because it is free and a scan left red for a known-harmless
+  reason is how a real finding gets missed later.
+
+### Fixed
+
+- The release workflow attaches its archive again. `gitea.com/actions/release-action`
+  declares `using: go` and has to be compiled by the runner, which act cannot do
+  here — the 2.0.0 build went green and then died on the publish step with
+  exit 127, leaving an announced release with no download. Publishing runs
+  through the Gitea API with curl now, and is idempotent so a recovery run
+  replaces the asset instead of tripping over it.
+
+---
+
 ## [2.0.0] — 2026-08-19
 
 Rebuilt, repaired, reset. Everything developed as v1.6.0 through v1.15.0 ships