chore: prepare v0.21.0-rc2 release candidate

[stephenschoettler]

Summary

• Advance canonical release identity from 0.21.0-rc1 to 0.21.0-rc2 across the manifest, docs, issue template, and direct identity assertions.
• Add RC2 release notes limited to merged fix: preserve Unicode boundaries in tiktoken state chunks #492's CJK-safe optional-tiktoken trajectory-state chunking correction.

Why

• fix: preserve Unicode boundaries in tiktoken state chunks #492 landed after the RC1 candidate and fixes UTF-8 boundary handling in oversized trajectory-state chunks. RC2 needs a consistent version identity and narrowly scoped release notes for that merged correction.

Validation

• Focused validation: PYTHONPATH=<hermes-agent-checkout> uv run --with pytest --with tiktoken pytest tests/test_release_workflow.py <runtime-identity tests> <CJK chunking regressions> -q -> 14 passed
• Default validation:
  • pytest tests/test_lcm_core.py tests/test_lcm_engine.py tests/test_packaging_install.py -q
  • pytest -q
  • bash -lc 'ulimit -n 1024 && pytest -q'
  • python -m compileall -q .
  • python -m py_compile scripts/import_lossless_claw.py
  • bash -n scripts/install.sh scripts/update.sh
  • git diff --check
• Workflow validation, if workflows changed: actionlint

Notes

• Exact candidate: 8591f500c1a1865f6d0249e42018721b1d4a2100, one commit over e1977c68503d8a862da20b6cf12d054977dcc1c2.
• scripts/validate_release.sh --keep-going passed on the exact candidate, including compile checks, focused pytest, benchmark smoke, and stress smoke.
• Independent review also passed focused tests, release smoke, changed-test lint, object identity, and transport rehydration for this exact candidate.
• Full-suite validation was not repeated for this metadata-only candidate. The required Python 3.11/3.12/3.13 CI matrix remains authoritative.
• No workflow or runtime implementation files changed, so actionlint is not applicable.

Refs #492

[Tosko4]

Lgtm