chore(release): 0.2.2

[Pushkinist]

Release prep for v0.2.2 — version bump + CHANGELOG only (no code changes).

0.2.2 is a multimodal release covering everything merged since v0.2.1:

• Whisper transcription unreliable: greedy_decode lacks in-loop logit suppression; long-form + transcribe CLI missing #119 — reliable Whisper transcription (large-v3 token-shift + logit filters + long-form) and a model-agnostic rmlx transcribe CLI.
• Support Gemma4 'unified' any-to-any arch (Gemma4UnifiedForConditionalGeneration): vision/audio early-fusion soft tokens #120 — Gemma 4 12B gemma4_unified any-to-any image + audio input (encoder-free early-fusion soft tokens).
• Gemma4 audio input silently dropped: audio_tower never loaded in serve, input_audio is a no-op #122 — Gemma 4 native audio input wired through the serve path (Conformer tower).
• Gemma4-unified vision embedder corrupts colors (white→black, yellow→purple, green→black); e4b SigLIP path correct #127 — unified-vision color fix via bidirectional attention on image soft tokens.
• Gemma4 unified 12B: degenerate output under 4-bit weight quant (affine-4bit + mxfp4); mxfp8 OK #121 — templated --probe-smoke seed (kills the false BrokenPunctLoop).
• chore(security): pin CI actions to SHAs, cosign release signing, drop stale advisory ignore #116 / docs(releasing): formula url-bump + Dependabot migration-push gotchas #115 / fix(release): source_sha256.sh --write also bumps the formula url #118 — cosign release signing, CI action SHA pinning, release-script fixes.

make ci green locally (fmt + clippy + test + deny + audit). Tag + binary package + cosign signing + Homebrew formula bump follow after merge, per docs/RELEASING.md.