* Add .markdownlint.json + .markdownlintignore so markdownlint-cli2 honours the project's 100-char line length (code blocks/tables/headings exempt) and skips .venv/.
* Fix stray '#' in dependabot-auto-merge.yml comment introduced by a YAML formatter rewrap.
* Reflow ci.yml comment block (cosmetic).
* Bump version 2.0.2 -> 2.0.3 and document CI hardening / governance work in CHANGELOG.
No runtime changes.
Mitch
b671f7be7e