release: 2.3.0 (discovery + streaming + conformance/spec + auth mechanism) (#75)

Repo-level release for the work since 2.2.0 (#66-#74 + cross-host A2A validation):
- root version 2.2.0 -> 2.3.0
- CHANGELOG [2.3.0]: discovery complete, streaming complete, auth/authz enforcement
  mechanism, conformance extended to all wire types, versioned protocol spec; Changed:
  centralized stableEnvelopePayload; Fixed: de-flaked C2; Validated: real cross-host A2A.
  [Unreleased]/Pending: daemon auth end-to-end wiring + npm republish @ 0.2.0.
- README: What's New in v2.3 + Roadmap (streaming + discovery -> delivered; auth =
  mechanism shipped, daemon wiring remaining; A2A cross-host note).
- Package versions: core/federation/broker-nats -> 0.2.0 (new public API); cascaded all
  workspace dep ranges to ^0.2.0 so workspace resolution + CI npm ci stay consistent.

npm REPUBLISH is intentionally NOT done here (OTP-gated to Alex); it fixes the consumer
caveat that published core@0.1.0 predates stableEnvelopePayload / authToken / authorizeInbound.

Verified: npm install re-links @murmurv2/core@0.2.0 -> ./packages/core locally; build PASS;
full npm test 0 fail (unit 68, core 49, federation 30, a2a 6, broker-ws 4, federation-nats 10);
git diff --check clean.

Co-authored-by: alexfrmn <freedmancolin@gmail.com>