Wintermute 0.3.0 — promotion of the 0.2.x line (review + fix sweep)

Promote the feature-complete 0.2.x line (single-node → distributed → gen_server
→ application → persistent node → release → self-contained target system →
native interop) to 0.3.0. This is a hardening/consolidation release: no new
capability, no transpiler or pkg/otp change.

Control-node hardening + DRY:

• The short-lived control nodes for stop/status/call/attach now load the
  RCE-grade Erlang distribution cookie from a 0o600 erl -args_file
  (cookieArgsFile) instead of -setcookie on argv (previously visible via
  /proc/ps for the sub-second lifetime) — closing the last cookie-on-argv
  residual from 0.2.5. A shared controlTarget preamble replaces the duplicated
  resolveApp→parseVersionFlag→readState→NewLayout in the three resolveApp-based
  commands, and folds in erlang.ValidateVersion (previously unenforced for
  stop/status/call/attach).

Security-review sweep (whole 0.2.x surface — no Critical/Important found; four
Minor hardenings folded):

• validVsn rejects "..".
• Untar rejects absolute/traversing symlink targets and surfaces os.Symlink errors.
• The generated bin/stop halts non-zero when the target node is unreachable
  ({badrpc,_}), instead of always exiting 0.
• validAppName rejects shell/Erlang-dangerous characters (still accepts dotted
  versions and lowercase app/module names).

Test hygiene:

• The integration tests no longer leak detached beam.smp nodes: bin/stop's exit
  status cannot be trusted (async init:stop/0 + a stale baked-in rpc target once
  the test rewrites vm.args), so cleanup now SIGKILL-sweeps any node rooted at
  the test's unique temp dir.
• CutSuffix nit in resolveApp.

All green on real OTP 29.0.3: unit suite; ladder (24 rungs) and CLI integration
(0.2.5 e2e + rung VII + native e2e), no leaked node; govulncheck/gitleaks clean;
gosec 5 HIGH all accepted G703 (path-traversal-taint on wm's own artifacts).

Signed-off-by: Boris Mühmer 328183+bsmr@users.noreply.github.com