Release 2.0.0: encrypted client session + security fixes

[bradgessler]

First stable v2 (2.0.0) cut. The Go client is in production, so v2 leaves alpha. The V2 namespace stays for this release — collapsing it and dropping v1 coexistence is deferred to a later backwards-incompatible release (2.1+).

Security

• Rails client session is now signed AND encrypted (AES-256-GCM via ActiveSupport::MessageEncryptor), key derived from secret_key_base with a Terminalwire-specific salt, 30-day sliding expiry. Was a signed-only HS256 JWT — the docs said "encrypts and signs" but the payload was readable by anyone who could read session.jwt. Legacy JWT sessions are read once and rewritten encrypted, so upgrading logs nobody out.
• Exit-status integrity: a command calling exit/abort (SystemExit) now reports its real status instead of silently telling the client exit 0.
• Doc/comment accuracy: fixed the stale "JWT session" label, flagged that client_ip proxy headers are spoofable (not for authz), and corrected the false "capabilities gate request()" claim.

Dependencies

• Bumped vulnerable transitive gems in the root lock (rack, json, addressable, msgpack). bundle-audit is clean.

Release mechanics

• Terminalwire::V2::VERSION → 2.0.0; CHANGELOG finalized.
• Removed the ship-guards + rubygems.invalid push host from the terminalwire and terminalwire-rails gemspecs; updated docs/RELEASING.md; ignore built *.gem.

Tests

107 v2 + 96 v1 examples, 0 failures. Both gems build cleanly at 2.0.0.

⚠️ Not done here (deliberate)

• gem push to RubyGems — irreversible + your RELEASING.md flags the terminalwire name's proprietary history, so publishing is held for explicit go.
• The v2.0.0 git tag — should land on the merge commit on main.
• Conformance corpus pre-flight (make ruby RUBY_REPO=…) needs the terminalwire/protocol workspace and hasn't been run here.
• The broader flagged security issues (unauthenticated WebSocket command surface, DoS caps, Host-header→browser.launch, v1-gem gaps) are documented in the audit but not addressed in this release.

https://claude.ai/code/session_01WwjwiDDzoEczBXBuT5yZbd