v2.0.1: first signed-update release (with CI hardening)

First production release through the signed-manifest auto-updater.
Includes ZipFile.CreateFromDirectory swap for the artifact archive
step (Compress-Archive consistently hit the 20-min job timeout on
800 MB CPU bundles).