v0.3.0

Added

• Upgrade skill — consumer-side selective apply: reads kit-changelog.yaml, resolves the baseline (recorded-commit-first), and applies only the changes still relevant to a diverged install, on a work branch (never a blind merge). Safe by construction: an auto-apply allowlist (no upstream→RCE), secret-path guards, git 3-way merge with inline markers, per-area validation, and a resumable tracker. detect/apply are never executed. (6350d64)