docs: prepare v2.1.0 publication

[RomeoRaven]

Summary

• publish a pinned, verified v2.1.0 checkout for the complete 14-module catalog
• add checksum-bound, race-safe standalone commands for all ten new Linux diagnostics
• promote the four existing module commands to the v2.1.0 tag
• remove release-candidate/hold wording
• enforce exact canonical module commands and an exact fail-closed verified-checkout fence

Validation

• RED: 30 publication-contract failures before README finalization
• mutation proof: duplicate, no-op, and reordered module commands are rejected
• mutation proof: duplicate, reordered, split, appended, or extended checkout blocks are rejected
• GREEN: full suite 212/212
• runtime proof: verified checkout stops on clone or checksum failure and reaches doctor only after successful verification
• Linux modules 153/153
• launcher 102/102
• all 14 canonical README commands parse as Bash
• doctor, strict checksums, Bash parsing, pinned Docker ShellCheck, and diff hygiene pass

Publication boundary

This PR prepares documentation and tests only. The v2.1.0 tag and GitHub Release will target the exact post-merge master commit only after this PR is independently reviewed, all checks pass, and post-merge master CI succeeds.

[RomeoRaven]

Publication hold — independent review blocker

PR #22 is not merge-ready at head c873385e7427511b095d315eb01b48e044897f93.

The release documentation itself is correct, but tests/test-scripts.sh permits trivial or duplicate publication commands:

• duplicating the vps-profile.sh invocation still passed 219/219
• replacing it with a syntactically valid no-op containing only the expected URL, digest, mktemp, and trap strings still passed 219/219
• the catalog checkout test searches for clone/checksum/doctor independently instead of requiring one ordered block

Required before merge:

1. Require exactly one canonical command per module.
2. Validate the ordered download → checksum → chmod → execute chain.
3. Require one contiguous ordered clone → strict checksum → doctor block.
4. Add duplicate, no-op, and reordered-block mutation proofs.
5. Rerun all gates and complete a new independent exact-head review.

No merge, tag, or GitHub Release until those gates pass.