[sanskarIN]

Scope

• Add lineloom verify <file.vsix> [--preview] to authenticate a previously downloaded official VSIX against independently pinned stable or preview SHA-256 hashes.
• Stream a user-selected regular file only, with 1 KiB minimum/10 MiB maximum, refuse links and mismatches; never install, download, run editor commands or contact Ollama in verify mode.
• Add command parsing, negative verification regressions, and align CLI package metadata/lockfile with a development-only v0.2.0 candidate.
• Update CLI and distribution docs to distinguish already-published v0.1.0 from unpublished v0.2.0.

Verification requested

• Cross-platform npm package CI (Windows/macOS/Linux): npm ci --ignore-scripts --no-audit, npm test, package tarball validation.
• Main extension CI (manifest, source, VSIX smoke tests) and root security workflow as independent checks.

Release boundary

Do not publish or tag CLI v0.2.0 or LineLoom extension v1.2.5 from this PR. Existing v0.1.0 GitHub Packages publishing flag is version-pinned and cannot authorize v0.2.0. Root dependency audit remains independently blocked by security issue #79 (transitive @azure/msal-node advisory); manual workstation and Ollama QA remain pending.