build: bump anyplotlib pin to released 0.3.0

[CSSFrancis]

What

anyplotlib 0.3.0 is now released on PyPI. This bumps the dependency from the 0.3.0b1 beta to the release and re-locks, and fixes three pre-existing e2e failures on the base branch.

1. Dependency bump

• pyproject.toml: anyplotlib>=0.3.0b1 → >=0.3.0
• uv.lock: re-locked — anyplotlib resolves to 0.3.0 from the PyPI registry (released sdist/wheel + hashes), no editable path source.

2. e2e fixes (3 pre-existing failures, unrelated to the bump)

The feat/report-phase1 e2e run (29355241537, still on 0.3.0b1) was red on three specs. All were environmental / test-harness bugs, not product regressions, and none are caused by the anyplotlib bump:

• ipf_perf + movie_export — the backend-error audits tripped on [spyde RENDERER-ERROR] Failed to create WebGPU Context Provider, a benign warning Chromium emits from the figure iframe whenever the runner has no usable WebGPU adapter (every hosted CI runner under xvfb). anyplotlib falls back to Canvas2D and the render is still correct. Fix: exclude this line in backendErrorLines (_harness.cjs) and in ipf_perf's inline traceback filter — matching the existing exclusions for CSP / willReadFrequently / Chromium .cc(line) noise. A real Python traceback is never this renderer line, so real errors still fail the audit.
• report_sidebar fix(release): publish to the repo the workflow runs in (directelectron org doesn't exist yet) #6 — extracted the .spyde-report with tar -xf, but the container is a ZIP (PK magic); GNU tar on the Linux runner rejects it. Fix: use unzip on Linux/macOS (bsdtar reads zip on Windows, so that branch is unchanged).

Stacked on feat/report-phase1 (the report-builder branch, PR #8) since that branch is what depends on the 0.3.0 tile/annotation features and carries these specs. This clears the "bump anyplotlib pin before merge" item.

Verification

• uv lock → Updated anyplotlib v0.3.0b1 -> v0.3.0; uv sync --frozen builds a clean venv
• anyplotlib 0.3.0, _electron, spyde.backend.app, the tile backend, and all spyde/actions/report/* import cleanly (no API break beta→release)
• Full report-builder pytest suite: 171 passed
• e2e fixes verified without CI: backendErrorLines fed the exact failing CI log lines → WebGPU lines excluded, a real Traceback ... ValueError still caught, Chromium noise still excluded. A real write_report() .spyde-report (PK\x03\x04) reproduced the tar failure, then unzip -o -q extracted the expected report.md/figures//assets/ layout (exit 0). Both edited specs are TS-syntax-clean.

Note: build.yml's e2e job only triggers on PRs into main, so it does not run on this PR (which targets feat/report-phase1). These fixes take effect when feat/report-phase1 runs against main (PR #8). The e2e job is also continue-on-error: true (non-blocking).