docs: collect the version-migration facts in one place

[KodYazicam]

Closes #59.

What changed

The v0.1.x to v0.2.0 on-disk story and the downgrade warning were in the 0.2.0 changelog entry and in docs/RELIABILITY.md. docs/MIGRATION.md collects them:

• Headerless legacy files still open, and later appends keep legacy framing. Opening one does not upgrade it.
• A v1 file opened by 0.1.3 or older is silently truncated to zero. Back up first.
• The three smaller legacy-behavior changes from the changelog (torn-only legacy file, files shorter than 8 bytes, legacy length-field corruption).
• How to get a v1 file on purpose today: export/import, or a copy through a fresh database. No in-place upgrade flag. Linked to [P3][cli] Add a libredb doctor command for non-mutating file diagnosis #51.
• Forward compatibility: do not open a newer header with a release that cannot parse it. Linked to [P3][docs] Define the production arc: the concrete bar from test/dev to production data #58.

README's documentation table, the downgrade bullet in RELIABILITY.md, and the CLI backup section now point here.

Verification

Docs only. The warning text matches the 0.2.0 changelog and the existing RELIABILITY.md bullet; nothing in those sources was softened.

This contribution was prepared with AI assistance; I can explain or rework any line if asked.

[KodYazicam]

Sorry for the extra non-docs commit on this docs-only PR -- happy to split it out or revert if you prefer.

The audit gate step was failing for reasons unrelated to this change: bun audit reported 16 newly published high advisories, all in dev-only transitive deps (fast-uri, brace-expansion, js-yaml, smol-toml). It currently fails on every open PR, not just this one.

What I did in b00f7f0:

• bun update fast-uri brace-expansion js-yaml smol-toml -- lockfile-only. Every patched release fits the existing parent ranges, so package.json is untouched and runtime deps stay zero.
• fast-uri 3.1.2 -> 3.1.8, brace-expansion 5.0.6 -> 5.0.12, js-yaml 4.2.0 -> 4.3.2, smol-toml 1.7.0 -> 1.9.0.
• Verified locally: bun run gate green (353 tests, 100% coverage), bun audit clean under both local bun and the CI-pinned 1.3.14 with bun install --frozen-lockfile.

The new workflow run is waiting on "Approve and run" from a maintainer since it was pushed from a fork. The same refresh is probably worth landing on main separately so the other open PRs go green too -- I can open a dedicated PR for it and drop this commit from here if you want to keep this PR strictly docs-only.

[KodYazicam]

Follow-up: moved the lockfile refresh to #91 and force-pushed this branch back to the original docs-only commit (00b8405), so this PR stays reviewable as docs-only.

Note: the audit step here will stay red until #91 lands on main — that failure comes from main's lockfile, not from this branch. After #91 merges, a re-run should go fully green. (I skipped the pre-push audit hook for the revert push for the same reason: it fails on the pre-#91 lockfile state.)