feat: witryna 0.2.0HEADv0.2.0main

Switch, cleanup, and status CLI commands. Persistent build state via
state.json. Post-deploy hooks on success and failure with
WITRYNA_BUILD_STATUS. Dependency diet (axum→tiny_http, clap→argh,
tracing→log). Drop built-in rate limiting. Nix flake with NixOS module.
Arch Linux PKGBUILD. Centralized version management.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 52 insertions, 3 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 18cc413..8a3a593 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,54 @@
 # Changelog
 
+## 0.2.0 — 2026-02-15
+
+### Features
+
+- **Manual build switching**: `witryna switch <site> <build>` command for
+  instant rollback to any previous build via atomic symlink swap
+- **Manual cleanup**: `witryna cleanup [site] [--keep N]` subcommand for
+  pruning old builds and logs
+- **Persistent build state**: `state.json` as single source of truth for
+  build status, timestamps, and git commit hash
+- **Active build marker**: `witryna status` shows `+` next to sites with
+  builds in progress
+- **Hook build status**: `WITRYNA_BUILD_STATUS` environment variable
+  (`"success"` or `"failed"`) passed to post-deploy hooks
+
+### Breaking Changes
+
+- **Post-deploy hooks now run on all builds.** Previously hooks only ran
+  after successful builds. They now also run after build failures, with the
+  new `WITRYNA_BUILD_STATUS` environment variable set to `"success"` or
+  `"failed"`. Update existing hooks to check `WITRYNA_BUILD_STATUS` if they
+  should only run on success (e.g. web server reload scripts).
+
+- **Removed built-in rate limiting.** The `rate_limit_per_minute` and
+  `trust_proxy` configuration options have been removed. Rate limiting
+  is now delegated to the reverse proxy (Caddy, nginx). See
+  `examples/caddy/Caddyfile` and `examples/nginx/witryna.conf` for
+  configuration examples.
+
+- **Dependency overhaul.** HTTP server replaced (`axum` → `tiny_http`),
+  CLI parser replaced (`clap` → `argh`), logging replaced (`tracing` →
+  `log`). Configuration format is unchanged but the binary is significantly
+  smaller and has fewer transitive dependencies (192 → 139 crates, −28%).
+
+### Internal
+
+- Replace `tracing` with `log` + custom `Logger` for smaller binary
+- `Box::pin` large futures to reduce async stack usage
+- Centralized version management via `Cargo.toml`
+- Drop `chrono`, `dashmap`, `tokio-util`, `subtle` dependencies
+- MSRV set to Rust 1.85
+
+### Packaging
+
+- **Nix flake** with NixOS module and VM integration test
+- **Arch Linux PKGBUILD** with packaging scripts
+- Add `git` and `git-lfs` to deb/rpm package dependencies
+- New integration tests for `validate` and `cleanup` CLI commands
+
 ## 0.1.0 — 2026-02-10
 
 Initial release.
@@ -11,12 +60,12 @@ symlink switching.
 
 ### Features
 
-- **HTTP webhook server** (axum) with bearer token auth, rate limiting,
-  and JSON error responses
+- **HTTP webhook server** (tiny_http) with bearer token auth and JSON error
+  responses
 - **Git integration**: clone, fetch, shallow/full depth, automatic
   submodule initialization, LFS support
 - **Containerized builds** via Podman or Docker with security hardening
-  (`--cap-drop=ALL`, `--network=none` default, resource limits)
+  (`--cap-drop=ALL`, `--network=bridge` default, resource limits)
 - **Atomic publishing** via timestamped directories and symlink switching
 - **Post-deploy hooks** with environment variables (`WITRYNA_SITE`,
   `WITRYNA_BUILD_DIR`, `WITRYNA_PUBLIC_DIR`, `WITRYNA_BUILD_TIMESTAMP`)