release 0.0.02: v2 MODEL/CLIP/VAE refactor + 3 hardening fixes; comfy 0.0.01->0.0.02

v2 node refactor: ModelLoader -> MODEL/CLIP/VAE sockets + BuildPipeline node,
QuantFuncMaskConfig/MaskScaleBy, format_adapters/ (BFL/SVDQ/bundled/HF), export
format rename. BREAKING: ModelLoader output type QUANTFUNC_PIPELINE -> MODEL/CLIP/VAE
and QuantFuncImageList input image1 -> main_image; old saved workflows need re-wiring.

Hardening (CR-driven, multi-dim review):
- fix: unlink /dev/shm QFRAW ref/mask staging files in a finally (tmpfs RAM leak)
- fix: zip-slip guard in dep-zip extraction (validate members resolve inside dest)
- fix: bound + consistency-check worker-reported image size before read/reshape

bump comfy 0.0.01->0.0.02 so auto_update pulls the shipped 0.0.07 engine.
(Deferred follow-up: supply-chain signing — SHA-256 verify downloads + opt-in git pull.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>