v0.3.0

fix: release workflow cargo --allow-dirty and npm auth

Cargo.lock is generated during build, causing cargo publish to
reject. Add --allow-dirty. NPM publish needs NODE_AUTH_TOKEN
env var wired to NPM_TOKEN secret.