v0.3.0

Adds relation traversal, leaving the laravel/mcp generator as the only thing
the README still lists as missing.

An agent may ask for declared relations to be expanded:

$resource->get($user, $id, include: ['comments']);

The target's own rules apply, not the parent's. Expanding comments
returns exactly what Comment declares in its own attribute, checked against
Comment's own policy, for the same signed in user. A relation composes two
exposures that already existed. It never creates a third.

A relation cannot reach a model you never exposed. If the target is not a
registered resource the call is refused, because there would be no field list
and no policy to apply. Registering a model with abilities: [] makes it
reachable through relations without publishing a tool that can enumerate it.

One level, never two. An expanded record does not itself expand. The next
hop is another tool call, separately authorized and separately recorded.
Walking the object graph inside a single call is how one question becomes a
full export.

A to-many relation is capped by the target's own ceiling and reports truncation
rather than trimming quietly. A to-one the viewer may not see comes back as
null. Relations are eager loaded, so expanding across a page costs one extra
query rather than one per row, and a test asserts it.

verify() now catches a relation with no method behind it and one pointing at
an unexposed model, at deploy time rather than when an agent asks. The audit
trail records the ids reached through each relation, because "what did the
agent read" is wrong in exactly the interesting case if it stops at the parent.

49 tests across PHP 8.2, 8.3 and 8.4, up from 34.