Prepare resilient onboarding release v2.0.3

[Pavel-Tk]

Summary

• version the approved-device polling resilience as v2.0.3
• document Hermes 0.20.x compatibility and fixed content-free OAuth failure categories
• pin installer/package metadata and packaging tests to 2.0.3
• refresh exact-byte inventory, hosted-origin allowlists, and remote publication-history seal

Validation

• Ruff passed
• full suite: 245 passed
• pristine full-remote publication scan: no findings
• implementation commit ac6f1eeed6b9963b9d7964ee1d8e09f04b500c3c already passed adversarial critical-only review after its only critical finding was fixed

[Pavel-Tk]

Adversarial critical-only release-identity review: no critical findings. Version, installer, package metadata, exact-byte inventory, and publication seals are internally consistent. Full CI is green.