Crate major-version bump for the FrameKind break (types + host)

[macanderson]

PR #87 makes FrameKind an open vocabulary (ADR 0011). Wire-compatible, Rust-semver breaking:

• new Unknown(String) variant
• #[non_exhaustive]
• no longer Copy
• contextgraph_host::frame_kind_name becomes fn(&FrameKind) -> &str

contextgraph-types and contextgraph-host therefore need 2.0.0, while the protocol version stays contextgraph/1.0 — the two-axis distinction docs/stability.md describes, and its first substantive instance.

Definition of done

• Decide and apply the version bump across the workspace. workspace.package.version 1.0.0 → 2.0.0; all nine members inherit it. Verified: contextgraph-types v2.0.0 and contextgraph-host v2.0.0 in Cargo.lock.
• Move the internal dependency floors. contextgraph-* path deps went >=1.0.0 → >=2.0.0 in contextgraph-host, contextgraph-conformance, contextgraph-trace, contextgraph-mcp-bridge, contextgraph-mcp-server. This was not cosmetic: contextgraph-host 2.0.0 does not compile against contextgraph-types 1.x, so the old floor admitted a resolvable-but-unbuildable pair.
• A MIGRATION.md entry. §5 covers the wildcard match arm, .clone() where Copy was relied on, and & at frame_kind_name call sites — each a compile error, none a silent runtime change — plus the SDK lockstep note.
• Check whether the other published crates need a bump for re-exported surface. They do, and they get it automatically: contextgraph-conformance and contextgraph-trace both re-export contextgraph-types surface and inherit the workspace version. Verified they cargo check clean at the new floors.
• Confirm downstream consumers (stella) are ready. The stella builds against CGP HEAD job passes on Sign the provenance chain, open the FrameKind vocabulary #87.
• Correct the stability contract that forbade this bump. docs/stability.md said a breaking redesign required "both contextgraph/2.0 and crate version 2.0.0" — two lines after declaring the axes independent, which would have made a wire-compatible crate major illegal. It now states the implication in the direction that holds.
• Tests, docs, CI. cargo check/test/clippy -D warnings clean on contextgraph-types + contextgraph-host (136 host tests, 132 types under --features attestation, 5 reference vectors, 0 failures); cargo fmt --check clean; CHANGELOG.md records the bump and the reasoning under [Unreleased].

Out of scope, tracked separately

The Go SDK is unchanged in this release; porting it is #93. The Python and TypeScript SDK manifests did move to 2.0.0 here, because FrameKind widens in both type systems and an exhaustive switch relying on never-narrowing stops type-checking — the same break in a different language, so lockstep was the honest call rather than deferred work.