docs(v0.3.0): UTXO program — full migration vs hybrid, head-to-head, F8 analysis + draft release notes (PLANNED, NOT SHIPPED)

[cloudzombie]

What this is

Documentation and research only. Two files in notes/; no consensus code, no crate changes, no genesis impact, no tag, nothing armed.

• notes/v0.3.0-program.md — the v0.3.0 program document, sibling in format/rigour to notes/v0.2.0-program.md:
  • Ground truth of the current account/nonce model, every claim pinned to file:line at HEAD 3712b03 (gap-free nonce rule, 256 per-sender cap, five frozen nonce bindings, 5.3 KB hybrid envelope, turnstile pattern, F6 gap).
  • Option A — full migration: eUTXO-with-typed-locks model, output/tx/sighash formats (hybrid Ed25519+ML-DSA-65 preserved, Bound-only domain framing from birth), conversion mechanics at height H committed by the state root itself, and the honest cost: both execution engines forever.
  • Option B — the hybrid (per the added owner scope, same document, head-to-head): a transparent UTXO cash lane beside accounts, turnstiled exactly like the shielded pools already are, XUS-only at ship, dormant behind BIP-9 bit 3.
  • Option C — queued nonces / cap raise / access lists / pools-carry-value, each given a fair hearing.
  • Subsystem-by-subsystem breakage table (A vs B), adversarial-grade F8 analysis, head-to-head comparison, recommendation (hybrid, sequenced AFTER v0.2.0 W2, with full migration kept open as the end-game), workstreams/slices/acceptance gates, risk register, open measurements, and an explicit assumptions register.
  • Three DECISION-NOW items, one urgent: pool-v2 D4 binds carrier auth to {tx signer, nonce} and is not yet coded — reword to {carrier tx id} before W2 lands.
• notes/release-v0.3.0-draft.md — draft release notes in the release-v0.2.0.md honest voice, banner-marked PLANNED — NOT SHIPPED, explicit that no v0.3.0 tag or binary exists.

Do not merge

Left for the owner's morning read; merge is the owner's call.