release 0.2.0: security release, API unchanged at 0.1

- MANIFEST 0.1 -> 0.2.0 for the goal/security release (SA-4, SA-10,
  SA-6, SA-15, SA-12 frame expiry, signer assertion, endpoint guards,
  SSE caps, genkeys --out; SA-9 config-file permission warnings).
- split api_version ('0.1' — library/vapi/gir/pc artifact names, every
  downstream consumer depends on them) from release_version (project
  version, reaching only the pkg-config Version: field, which usm
  validates against the manifest version).

MANIFEST.usm

@@ -1,21 +1,23 @@
 {
-  "name": "statum",
-  "version": "0.1",
-  "summary": "Page rendering and state management for web applications",
-  "licences": [],
-  "flags": ["ninjaStyleProgress"],
-  "provides": {
-    "lib:libstatum-0.1.so": "as-expected",
-    "bin:statum-mkpstm": "as-expected",
-    "bin:statum-mkres": "as-expected",
-    "bin:statum-genkeys": "as-expected",
-    "inc:statum-0.1.h": "as-expected",
-    "vapi:statum-0.1.vapi": "as-expected",
-    "gir:statum-0.1.gir": "as-expected",
-    "pc:statum-0.1.pc": "as-expected"
+  "name" : "statum",
+  "version" : "0.2.0",
+  "summary" : "Page rendering and state management for web applications",
+  "licences" : [],
+  "flags" : [
+    "ninjaStyleProgress"
+  ],
+  "provides" : {
+    "lib:libstatum-0.1.so" : "as-expected",
+    "bin:statum-mkpstm" : "as-expected",
+    "bin:statum-mkres" : "as-expected",
+    "bin:statum-genkeys" : "as-expected",
+    "inc:statum-0.1.h" : "as-expected",
+    "vapi:statum-0.1.vapi" : "as-expected",
+    "gir:statum-0.1.gir" : "as-expected",
+    "pc:statum-0.1.pc" : "as-expected"
   },
-  "depends": {
-    "runtime": [
+  "depends" : {
+    "runtime" : [
       "lib:libglib-2.0.so.0",
       "lib:libgobject-2.0.so.0",
       "lib:libgio-2.0.so.0",
@@ -26,7 +28,7 @@
       "lib:libsodium.so.26",
       "lib:libxml2.so.2"
     ],
-    "build": [
+    "build" : [
       "bin:valac",
       "bin:meson",
       "bin:ninja",
@@ -47,13 +49,13 @@
       "pc:invercargill-sql.pc",
       "pc:invercargill-sql-inversion.pc"
     ],
-    "manage": [
+    "manage" : [
       "bin:bash"
     ]
   },
-  "execs": {
-    "build": "usm-scripts/build.sh",
-    "install": "usm-scripts/install.sh",
-    "postInstall": "usm-scripts/post-install.sh"
+  "execs" : {
+    "build" : "usm-scripts/build.sh",
+    "install" : "usm-scripts/install.sh",
+    "postInstall" : "usm-scripts/post-install.sh"
   }
-}
+}

meson.build

@@ -1,5 +1,5 @@
 project('statum', ['c', 'vala'],
-  version: '0.1',
+  version: '0.2.0',
 )
 
 vapi_dir = join_paths(meson.current_source_dir(), 'vapi')

src/meson.build

@@ -63,8 +63,13 @@ sources = files(
     'Slot.vala'
 )
 
-library_version = meson.project_version()
-libstatum = shared_library('statum-@0@'.format(library_version),
+# The API version rides every artifact name (libstatum-0.1.so,
+# statum-0.1.vapi, ...); the project version is the release version and
+# only reaches the pkg-config Version: field (usm checks it against the
+# manifest version).
+api_version = '0.1'
+release_version = meson.project_version()
+libstatum = shared_library('statum-@0@'.format(api_version),
     sources, client_script, client_worker,
     dependencies: [
         glib_dep,
@@ -83,14 +88,14 @@ libstatum = shared_library('statum-@0@'.format(library_version),
         invercargill_sql_inversion_dep,
     ],
     install: true,
-    vala_gir: 'statum-@0@.gir'.format(library_version),
+    vala_gir: 'statum-@0@.gir'.format(api_version),
     install_dir: [true, true, true, true]
 )
 
 pkg = import('pkgconfig')
 pkg.generate(libstatum,
-    version: library_version,
-    name: 'statum-@0@'.format(library_version))
+    version: release_version,
+    name: 'statum-@0@'.format(api_version))
 
 statum_dep = declare_dependency(
     link_with: libstatum,