release: v0.2.0 — bump control + cli to 0.2.0 (version-before-tag)

[andrescera]

What

Release-prep for v0.2.0: bump @ceralive/modem-control (control/package.json) and the
private bench CLI (cli/package.json) from 0.1.0 to 0.2.0. No code or behavior changes —
version fields only.

Why

This is the version-before-tag step of the SemVer release contract
(docs/VERSIONING.md §"npm version provenance"): the release workflow's publish-npm job
verifies (does not inject) that control/package.json version equals the release tag's
X.Y.Z and fails closed on any mismatch. To cut v0.2.0 — which ships the MM 1.24.2 /
libmbim 1.34.0 / libqmi 1.38.0 / libqrtr-glib 1.4.0 stack plus the Wave-2/3 hardening already
merged in #5 — both workspace versions must read 0.2.0 on main before the tag is created.

How to verify

• control/package.json and cli/package.json both show "version": "0.2.0".
• bun install --frozen-lockfile exits 0 and git diff --exit-code -- bun.lock is clean
  (workspace members resolve by path, so the lockfile is unchanged and reproducible).
• bunx tsc --noEmit and bunx biome check . stay green (a version bump touches neither).
• CI ci-bun (lint/typecheck/test) and ci-packaging (bookworm contract) pass.

Risks

Minimal. The change is two one-line version edits. The .deb side is unaffected (its version
is injected from the tag, not from package.json); the npm side simply now matches the tag it
will be published under. The unified v0.2.0 tag is created only after this merges to main.