Bump version to 0.2.0

[zmofei]

The command renames in mapbox-cli-private's CHANGELOG.md (#116's geocoder/static/tilesets rename, mapbox-cli-private#143) are breaking while this crate is 0.x, so the minor version moves per CONTRIBUTING.md's Compatibility section.

Cargo.toml + Cargo.lock only.

[mattpodwysocki]

Approving — the bump itself is complete, and I checked that rather than
assuming two lines were enough.

Nothing else in this repo names the version. Cargo.toml is the only
place 0.1.8 appears outside CHANGELOG.md, and every consumer derives it:
main.rs's .version(env!("CARGO_PKG_VERSION")), schema.rs,
generate_skills.rs, and telemetry.rs's PRODUCT_TOKEN — which is what
puts mapbox-cli/0.2.0 on every request's User-Agent. The lock's own
mapbox-cli entry moves with it. So this is the whole change.

0.2.0 is the right number: the renames in #8 are breaking, and the pre-1.0
rule in CHANGELOG.md raises the minor for those. 0.1.8's own entry already
said "The next release is 0.2.0".

One sequencing problem, and it is not in this PR

mapbox-cli-private#143's oss pin is a4fb8347, which predates #8.
Public main is now 3a818d2. So as it stands, #143 carries the changelog
entry describing nine renamed commands while pinning a submodule commit in
which nothing is renamed — the entry would describe a binary that does not
exist.

It would be caught, but by accident rather than by design.
check-release-ready.sh compares oss/Cargo.toml's version against the
## <version> heading, so a pin at a4fb8347 (0.1.8) against a ## 0.2.0
heading fails on the version. Advancing the pin to fix that happens to pull
in the renames too, because this bump sits downstream of them in main.
Nothing checks that the pinned tree actually contains what the entry claims;
the version acts as a proxy, and it works here only because of merge order.

So the order that holds:

1. This PR last among the public merges — #8 is in, and #11 if you want
   its three tests. The bump is the marker saying "this tree is 0.2.0", so
   everything 0.2.0's notes claim should already be under it.
2. Advance #143's pin to public main including this commit.
3. Merge #143 and mapbox-cli-private#146 — #146 is what makes
   prepare-release.sh run at all; without it the script refuses with
   "## Unreleased section is empty, so there is nothing to release."
4. sh scripts/prepare-release.sh 0.2.0, then tag.

A snag at step 4 that this PR happens to route around

prepare-release.sh predates the submodule, and its own comment predicted
it: "the day oss/ becomes its own repository this is the line that
changes." It hasn't. Verified in a fresh --recurse-submodules clone:

• the git add CHANGELOG.md oss/Cargo.toml oss/Cargo.lock it prints fails
  with fatal: Pathspec 'oss/Cargo.toml' is in submodule 'oss';
• the git diff it tells you to read shows CHANGELOG.md | 2 ++ and
  oss | 0 — it hides the version bump, which is only visible under
  git -C oss diff.

Doing the bump as this PR instead of letting the script do it sidesteps both,
and it is the approach I would have picked: a push to a soon-to-be-public repo
stays a deliberate act, the way tagging already is. Worth knowing the script's
printed instructions are still wrong for anyone who reaches for it next time —
after this, its only remaining job is renaming the ## Unreleased heading, and
the only file to git add is CHANGELOG.md.