sic 0.2.0: nested targets + v2 argv-boundary wire (dual-read, backward compatible)

Bumps sicd + sic-agent (arch PKGBUILDs, debian build-deb.sh, both changelogs) to
0.2.0-1 against sic tag v0.2.0 (tarball sha fe0569013da5...). New tarball verified
building all four packages locally (debian amd64 debs + arch verifysource) before push.

What 0.2.0 ships (source git.reauktion.de/marfrit/sic @ 4fcd851):
  * Nested targets: sic host/hop1/hop2 cmd peels incus/docker/pct container hops,
    resolved via /etc/sic/hosts.toml, built as a netstring onion.
  * argv boundaries preserved end to end (length-framed [][]byte, never space-split)
    -- the founding guarantee: sic host touch 'a b' stays ONE file.
  * Daemon dual-reads v1 and v2 (first-byte dispatch), so pre-0.2.0 clients keep
    working during the staged rollout.
  * Client forwards stdin AFTER the frame (fixes the v0.1.0 zero-byte trap), ssh -T
    binary-safe, exit status inherited.
  * Hardened + reviewed (bullpen 964/970): outer-length cap before alloc, per-element
    and byte caps, explicit canonical argc (empty "" args representable).

Also removes continue-on-error from the four sic CI jobs (sicd/sic-agent x arch/debian)
so a broken build fails the workflow loudly instead of silently producing nothing --
the reason the sic jobs went unnoticed as never-succeeding since 2026-07-19.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

arch/sic-agent/PKGBUILD

@@ -3,7 +3,7 @@
 # Source of truth: git.reauktion.de/marfrit/sic
 
 pkgname=sic-agent
-pkgver=0.1.0
+pkgver=0.2.0
 pkgrel=1
 pkgdesc="sic client + agent skills: frame argv as netstrings and run it on a remote host via sicd (foreground + background skills)"
 arch=('x86_64' 'aarch64')
@@ -12,7 +12,7 @@ license=('MIT')
 makedepends=('go')
 depends=('openssh')
 source=("sic-${pkgver}.tar.gz::https://git.reauktion.de/marfrit/sic/archive/v${pkgver}.tar.gz")
-sha256sums=('5cd10c3a1ab7361e72e7579af5819f9d322ecd59424541cfb80e5b7514253511')
+sha256sums=('fe0569013da5bfa248743cd04bc2f09da8217b04432aa69827ed5287a133a37c')
 
 build() {
     cd "${srcdir}/sic"

arch/sicd/PKGBUILD

@@ -3,7 +3,7 @@
 # Source of truth: git.reauktion.de/marfrit/sic
 
 pkgname=sicd
-pkgver=0.1.0
+pkgver=0.2.0
 pkgrel=1
 pkgdesc="sic daemon: reads netstring-framed argv from stdin and execvp's it (deploy on remote/target hosts)"
 arch=('x86_64' 'aarch64')
@@ -12,7 +12,7 @@ license=('MIT')
 makedepends=('go')
 optdepends=('openssh: run sicd as an ssh ForceCommand / authorized_keys command')
 source=("sic-${pkgver}.tar.gz::https://git.reauktion.de/marfrit/sic/archive/v${pkgver}.tar.gz")
-sha256sums=('5cd10c3a1ab7361e72e7579af5819f9d322ecd59424541cfb80e5b7514253511')
+sha256sums=('fe0569013da5bfa248743cd04bc2f09da8217b04432aa69827ed5287a133a37c')
 
 build() {
     cd "${srcdir}/sic"