v2.0.1

Two supply-chain fixes from the security review of 2026-09-08.

The AWS CLI is verified before it is installed. It was the only tool in
toolchain.lock.toml carrying no checksum, installed with curl, unzip and
./aws/install as root, and it is the binary that receives the R2 credentials on every
upload. AWS publishes no checksum for the v2 Linux installer, only a detached PGP
signature, so the fetch stage now verifies that signature through the same
GOODSIG-and-VALIDSIG gate the engine uses for TeX Live, against the key committed at
docker/aws-cli.pub and the fingerprint pinned in the lock. gpgv's own verdict is not
the gate: a zip signed by any other valid key still reports a good signature, and only
the fingerprint comparison refuses it.

That key expires 2027-07-01. An expired key is EXPKEYSIG, not GOODSIG, so builds
after that date fail closed until docker/aws-cli.pub is refreshed from the AWS CLI
User Guide.

The sync workflow refuses a hostile vars input. Its words become go-task call
variables, which the engine splices into shell as raw text, so a crafted RECONCILE or
BATCH_GB could run arbitrary commands in the step that had already exported every
inherited secret, including the R2 credentials and OP_SERVICE_ACCOUNT_TOKEN. A word
that is not a bare upper-case key and a plain value is now refused at the boundary, in a
step that holds no secrets. reconcile's status quotes its value as well. BATCH_GB
lands inside $(( )), where a quoted operand is a syntax error, so it stays bare and
carries a ponytail: comment naming what protects it.

Each guard's own cases run in CI and prove what it refuses; the image build proves what
the signature gate accepts.

No mirror needs a change. Neither fix alters a rendered command, so render.txt in
ctan and tlnet still matches, and the rollout is the v2 tag as usual.