Release v3.1.0

Changes

New Features

• New seccomp.profile challenge option names a JSON profile sitting beside
  problem.md, replacing cmgr's embedded policy for that challenge's runtime
  containers. Build, artifact, and solver containers keep the embedded policy.
  Profiles are validated at load time and contribute to the challenge's source
  checksum, so editing one triggers a rebuild. A per-host overrides block does
  not inherit a top-level profile. Adds a containerOptions.seccomp column,
  migrated automatically on open; challenges selecting no profile are unaffected.

  • New examples/seccomp/: the embedded policy as a copyable default.json
    baseline, execstack.json and no-ptrace.json, a profile-diff.py tool that
    reports only a profile's semantic delta from the baseline, and a README on
    what the default policy already permits. examples/execstack/ is a worked
    challenge for the READ_IMPLIES_EXEC case.

• Artifact archives from build containers are now validated on ingest instead of
  repacked verbatim: path traversal, absolute paths, symlinks, hardlinks, device
  nodes and duplicate entries are rejected, ownership and xattrs are stripped,
  and entry count, per-file and total decompressed size are bounded (including
  tar metadata records). Archives stage to a temp file and rename into place, so
  a failed build can no longer replace a good archive with a partial one. Limits
  are tunable via CMGR_MAX_ARTIFACT_FILES, CMGR_MAX_ARTIFACT_BYTES, and
  CMGR_MAX_ARTIFACT_FILE_BYTES. Ported from ArmyCyberInstitute/cmgr bdbf839.

Updates

Dependencies: dropped github.com/docker/cli in favor of an in-tree NanoCPU
parser, migrated gopkg.in/yaml.v2 to go.yaml.in/yaml/v3, and bumped
go-sqlite3, goldmark, and moby/moby/client.