0.2.0: tool polish, sanitization hardening, and CI

[Shayanide]

Bundles the recent ergonomics work, security hardening, and release-engineering bring-up into a single 0.2.0 cut.

Tooling

• Refines docstrings across add_credits, the chain-plan formatter, and the module headers of server.py and sanitize.py.
• Adds retry_failed_datapoints wrapping POST /jobs/{id}/retry.
• check_survey now surfaces audience targeting and response options when set.
• upload_media reads with a top-line per-file summary; references and failures grouped beneath.

Sanitization

• Adds NFKC normalization, zero-width / bidi / BOM stripping, C0/C1 control stripping (preserving tab and newline), and Markdown link/image defanging on top of the existing HTML-tag strip and length cap. The defang handles arbitrarily nested brackets.

Release engineering

• New CI workflow runs ruff check and pytest -v on every PR and on pushes to main. Single Python 3.12 job, 10 min timeout, concurrency cancel-in-progress, uv-cached.
• Adds a [project.optional-dependencies] dev extra so CI and local dev share one source of truth.
• Bumps pyproject.toml, server.json, and .claude-plugin/plugin.json to 0.2.0.

Test plan

• pytest tests/ — green (135 tests)
• ruff check mcp_server tests — clean
• CI workflow runs on this PR and stays green
• retry_failed_datapoints re-queues failures; 400/404 paths render friendly text
• check_survey shows targeting / distribution / response options when present
• upload_media summary reads cleanly across success / partial / all-fail / empty
• Sanitizer strips invisibles, controls, defangs nested-bracket links, normalizes lookalikes