docs: fix stale v2.0.0 pins and the quickstart's process-module guidance for the v2.1.0 line #552

Goal

Make the consumer-facing install and pin instructions agree with the stated current release (v2.1.0) before v2.2.0 is prepared.

Background

README.md and docs/versioning-policy.md declare v2.1.0 the current stable release, but the copy-paste pin instructions still resolve to the v2.0.0 commit:

• README.md:155-164 says "Pin the checkout to the full current release commit" and uses b4243765726c133499feeabdc50154f99c0fec12. That is the v2.0.0 commit; v2.1.0 is 36fec50c446dcea8c521a1ba3e7fee2394f169c0. README.md:244-245 then refers to "the v2.0.0 pin above", so the section contradicts itself.
• docs/versioning-policy.md:127-137 ("Immutable Consumption") says to use the canonical v2.0.0 asset and the commit "resolved from the signed v2.0.0 tag". The tag is annotated but carries no PGP/SSH signature (git cat-file -p v2.0.0), and docs/release-process.md consistently says "annotated".
• docs/v2/quickstart.md:9-27 pins v2.0.0 and tells readers the preview process module "is not present in this v2.0.0 checkout. Follow the next release's documentation after a release containing that module is published". v2.1.0 is that release (README.md:35, lib/bash/process/README.md:8-10).
• docs/pinned-consumption.md:30 already names the v2.1.0 asset set, so the pin docs disagree with each other.

Scope

• Decide per document whether the example should pin the current release (v2.1.0) or intentionally demonstrate the GA baseline; state which in the text.
• Update the README, versioning-policy, and quickstart pins/commit values and tag-resolution wording accordingly; replace "signed" with "annotated" (or actually sign the tag).
• Rewrite the quickstart's process-module note so it matches the shipped state.
• Add or extend a validation check so the README "current release" pin cannot drift from the VERSION/tag it names (the release-preparation sequence should then update it deliberately).

Acceptance Criteria

• No document labels a v2.0.0 commit as the "current release".
• README, versioning-policy, quickstart and pinned-consumption name the same release for the same purpose, with the correct full commit.
• "signed tag" wording matches how the tag is actually produced.
• The quickstart no longer says the process module is unreleased.
• A test fails if the README pin commit does not match the tag for the declared current release.
• docs/release-process.md lists the pin update as a release-preparation step.

Validation

Run ./tests/validate.sh; run the quickstart commands from a clean directory against the chosen tag; verify the commit with git rev-parse <tag>^{commit}.

Evidence

• README.md lines 9, 155-164, 239-245
• docs/versioning-policy.md lines 5-14, 127-137
• docs/v2/quickstart.md lines 9-27
• docs/pinned-consumption.md line 30

Project Fields

• Status: Backlog
• Priority: P1
• Area: Docs
• Size: M
• Issue type: Task
• Assignee: codeforester
• Milestone: v2.2.0

Agent Assignment

Assignee: @codeforester. Found during the pre-release documentation walkthrough of 2026-10-07 at the origin/main heads of base-bash-libs (454aabc) and base-bash-libs-demo (5e598be). No repository content was changed by the review.