v0.3.0 — upgrade diffs, sync/approve, trust context, MCP server

The release that turns a one-shot audit into a supply-chain workflow.

Highlights

• Behavioral upgrade diff — --diff compares upgraded packages against the base version and reports the capabilities the new version gained (⚠️ gained vs 1.2.0: net: fetch()): the fingerprint of a hijacked release, caught at PR review time.
• sync command — reconcile your allowScripts block with the lockfile. Decisions are preserved across upgrades that gained nothing, flagged for re-review when they did. --write applies, --check gates CI.
• approve command — interactive, evidence-per-package y/n flow that writes decisions to package.json.
• Trust context — every audited package is checked against OSV: MAL-* advisories render as ⛔ KNOWN MALICIOUS, are always false in allowScripts, and fail --fail-on-high. Risky packages get publish age, weekly downloads, maintainer count, and sigstore provenance.
• Via chains — via prisma → @prisma/engines on every finding, from lockfile dependency edges.
• --offline — audit node_modules on disk, zero network.
• bun.lock support — fourth lockfile ecosystem (npm, yarn classic+berry, pnpm v5/v6/v9, bun).
• MCP server — npx npm-script-lens mcp exposes audit_package / audit_lockfile so AI coding agents can vet a package before adding it as a dependency.

51 tests (offline mock registry + mock OSV + live acceptance), CI green on ubuntu/windows × node 20/22.

Full details in CHANGELOG.md.