feat(go)!: align envd user selection and prepare v0.2.0

[muxx]

Go callers could not select the sandbox user for command launch, PTYs, directory watches, or filesystem RPCs, although TypeScript and Python support it. Add per-operation User selection and unify filesystem methods around a final options argument. This PR also prepares the shared SDK version 0.2.0 in a separate release commit.

For example, Commands.Run(ctx, "id", &CommandOptions{User: "root", Args: []string{"-un"}}) runs as root, and Files.Stat(ctx, "~", &FileOptions{User: "root"}) resolves root's home directory. Empty users follow template defaults on envd >= 0.4.0 and select user on older envd. Existing-process operations keep the original process identity.

API changes

• Commands, PTY creation, and watches accept User string; filesystem requests use per-request headers without changing shared client state.
• File reads and simple filesystem RPCs accept *FileOptions; List takes *ListFilesOptions, batch writes take *WriteFileOptions, and signed URLs take *FileURLOptions.
• Breaking Go change: replace positional usernames with options, pass nil to formerly optionless filesystem RPCs, and move listing depth and signed URL expiration into options. ReadTo now takes (ctx, path, writer, options).
• Invalid usernames fail locally; unknown RPC users return typed authentication errors without retrying under a different user. Selection works with collecting output and streaming.
• Update examples and generated references. No backend or protocol changes are required.
• Bump every public package to 0.2.0 and align the Python Code Interpreter dependency with the 0.2.x core SDK; regenerate Python lock files.

Validation

• Go 1.24–1.27 build/test matrix; make go-check, including race, GoDoc, consumer installation, and 91.9% handwritten statement coverage.
• Hermetic tests for explicit/default/legacy users, concurrent calls, invalid users, streaming, metadata, header scope, and watch cancellation.
• TestEnvdUsersKVM passed on the local KVM runtime for root and user: actual process/PTY identity, file ownership, selected-user home paths, watch events, CRUD, and unknown-user errors. Test sandbox cleanup passed.
• Repository format, lint, type, and unit checks; deterministic generation; release artifact builds and clean-environment installation checks.
• The full v0.2.0 release artifact KVM suite passed: JavaScript, CLI, Python sync/async, Go core and Code Interpreter, private traffic, and temporary template builds with cleanup.

See the Go user-selection guide for the API mapping and migration notes. Version preparation does not tag or publish the packages.