chore(release): prepare 0.97.2

[msaad00]

Summary

• Bump release-managed package, UI, Docker, Helm, registry, OpenClaw, Snowflake, and docs surfaces to 0.97.2.
• Move [Unreleased] into the 0.97.2 changelog covering auth/OIDC bootstrap (fix(deploy)+feat(auth): self-host first-run bootstrap, anonymous demo, and guided OIDC/SSO setup #4335), Helm first-install auth Secrets (fix(helm): make control-plane self-host come up cleanly on first install #4337), attest CLI + demo/store-backed graph (fix(demo)+feat(attest,graph): harden demo path, MCP attest CLI, store-backed auto-enable #4336), and MCP honesty / audit exit codes (fix(mcp,audit): align tool-count honesty and rich audit exit codes #4346).
• Align product-screenshots.json metadata (no full PNG recapture). Blast-radius diagrams stay on the GitHub-safe generator art after a follow-up fix for marker-end CI failure.

Verification

uv run agent-bom --version   # 0.97.2
uv run agent-bom scan --demo --offline -o /tmp/ab-demo-scan.json
uv run agent-bom attest mcp sign ... --server filesystem-server --tenant-id demo  # signed=true
uv run agent-bom attest mcp verify ... --public-key ... --tenant-id demo
uv run agent-bom auth setup-oidc --provider google --client-id demo-client --base-url https://example.internal --non-interactive
helm lint deploy/helm/agent-bom
helm template ab deploy/helm/agent-bom -f deploy/helm/agent-bom/examples/eks-control-plane-sqlite-pilot-values.yaml
uv run python scripts/bump-version.py 0.97.2 --check
uv run python scripts/check_release_consistency.py
uv run python scripts/check_product_surface_contract.py
uv run python scripts/export_openapi.py --check
uv run python scripts/generate_agent_capability_manifest.py --check
uv run python scripts/lint_release_workflow.py .github/workflows/release.yml
uv run pytest -q tests/test_version_alignment.py tests/test_mcp_attest_cli.py tests/test_doc_architecture_svgs.py
# 16 passed (incl. GitHub-safe SVG guards)
curl -fsS https://demo.agent-bom.com/health
# status=ok, version=0.97.1 (hosted still on prior tag until release), unauthenticated_allowed=true

Notes

• Prepares the release only; does not tag or publish PyPI/Docker.
• After merge: tag v0.97.2 via the normal Release workflow.
• #4344 (external pre-install dependency risk signal proposal) is intentionally deferred — not a patch blocker.
• Screenshot PNGs remain the same-day 0.97.1 DEMO DATA capture; manifest visible_version/release_version aligned for the release gate.