Release v3.0.0

What's Changed

• Add kernel-level sandbox via nono-py for scan command by @christophetd in #712
• Reduce false positive noise, improve recall, add evaluation suite by @christophetd in #713
• fix(deps): vuln poetry (patch → 2.3.4) [.github/workflows] by @gh-worker-campaigns-3e9aa4[bot] in #731
• Adding dd-octo-sts by @sobregosodd in #732
• Fix tag release on bump by @sobregosodd in #733
• Sync CI parity from main by @sobregosodd in #743
• Bump v3 alpha release version by @sobregosodd in #744
• Align README with latest risk engine changes by @christophetd in #747
• Fix sandboxing for local scans and clean up dependencies by @christophetd in #753
• Remove deprecated CLI commands 'scan' and 'verify' by @christophetd in #754
• Port main PRs by @sobregosodd in #755
• Port PRs to v3 by @sobregosodd in #757
• Implement support for scanning local and remote archives by @christophetd in #756
• Fix v3 evals by @christophetd in #762
• Add writing-guarddog-rules Claude skill by @christophetd in #761
• Improve console output by @christophetd in #760
• Fix sandbox crash in human-readable reporter when stripping path pref… by @christophetd in #768
• Improve v3 rules by @christophetd in #764
• Improve false positive rate on real-world packages by @christophetd in #769
• Release v3 - 3.0.0a2 by @sobregosodd in #774
• Fix npm-http-dependency false positive on metadata URL fields by @christophetd in #778
• Add S3 scanning mode by @christophetd in #777
• Add nightly evals workflow by @christophetd in #770
• Rename main branch to v2 in CI workflows and docs by @sobregosodd in #783
• Release v3 by @sobregosodd in #784

Full Changelog: v2.10.0...v3.0.0