chore(release): 0.2.2

[clouddrove-ci]

Cuts the Unreleased section and repoints the Action examples at the new tag.

This is the release where pull request mirroring actually works

The feature shipped in 0.2.1. Four defects made it inoperable in practice, all found after the fact by reviewing the whole codebase rather than the diff:

• the destination repository path was owner-relative where every API wanted it qualified, so mirror_objects 404d on GitHub, GitLab, and Bitbucket
• Azure DevOps duplicated the project into paths that already carried it, 404ing on every repository
• concurrent repositories raced on shared state, which Go turns into an unrecoverable crash
• a pull request with no labels failed its own update — most pull requests have no labels

The last of those was caught by the new live test suite, on its first real run against GitHub, within a minute of the suite existing.

Two fixes that affect anyone on 0.2.1 today

Independent of pull request mirroring:

• Private Docker Hub repositories always failed. The login session token was discarded, so listings fell back to basic auth, which that API rejects — surfacing as a 404 blamed on the image.
• SyncerD parsed its own binary as its config. make build writes ./syncerd, and config discovery accepted that extensionless file, producing yaml: control characters are not allowed.

Also in this release

Eleven further correctness fixes (destination pull requests left open after their source merged, GitHub comment id spaces, lost comment ids on partial failure, cron overlap, signal handling, silent malformed globs, dropped Slack notifications, and more), every workflow action updated off the deprecated Node 20 runtime, both transitive Go advisories cleared, and the high-severity brace-expansion advisory patched.

Plus the thing that found the labels bug: a live provider test suite (make test-live) that creates throwaway repositories, mirrors a pull request between them against the real GitHub API, and deletes them. It has run green.

What this release does not prove

The live suite covers GitHub only, one shape: a same-repository pull request with one comment. GitLab, Bitbucket, Azure DevOps, and CodeCommit are still checked only against fakes, and fork heads and inline review-comment anchors remain unproven against a real API. Those are the paths I would trust least.

After merge

Tag v0.2.2. This tag also exercises the updated release.yml and helm-release.yml for the first time, since no pull request can.