Release v0.26.0-alpha.2 with current network repairs and usable downloads

[qh-work]

The installed alpha and public entrypoints lag behind the current network repairs; old download pointers lead to retired stable assets.

This packages authenticated replacement-node repair, opt-in deterministic retrieval v2, validated storage proofs, and signed topic/subscription authority as v0.26.0-alpha.2. It also fixes first-use sync-root permissions so fragmented transfers can resume. Canonical records and eleven MCP tools remain unchanged. Obsolete synthetic fixtures were repaired without dropping their safety assertions.

Validation:

• 65 changed source files and all 529 ZIP members passed bounded privacy and exact-byte review; private memory and machine configuration stayed outside the source and archives.
• 641 selected source tests passed, 10 were skipped, and one documented v1 ranking case remained an expected failure; no unexpected failures or errors. This is not an unqualified full-suite pass.
• 129 tests passed from the actual extracted review ZIP without skips; save/recall, hook, retry and inert restore checks also passed through the actual client ZIP and installed cache.
• All 15 TypeScript files passed strict checking. Required protocol CI passed on macOS, Windows and Ubuntu: https://github.com/qh-work/memory-vault-sync/actions/runs/33419028408
• All seven uploaded draft assets were downloaded and matched the reviewed bytes.

This remains an explicitly installed alpha. Real-cloud, real-model, native-Windows client, encrypted topic fan-out and 1,000-agent acceptance are not claimed. Older drafts and existing tags are unchanged.