v0.3.0

Changelog

• 4150726 docs: clarify the scope of dependency license notices
• 1aeda10 docs: define signed image delivery and catalogue policy
• bf400b3 docs: describe gated KVM image publication
• 80e6fdd docs: document catalogue refresh and image withdrawal
• 9af6cac docs: document public image delivery acceptance
• 66a3bfe docs: include notices for shipped Go dependencies
• 64ed1e0 docs: record public image acceptance and release setup
• 3f8f705 docs: record publisher runner requirements and trust boundaries
• c2d39d8 docs: require independent identities in public delivery checks
• a766627 feat: build and publish signed images through KVM acceptance gates
• d1d85e8 feat: refresh signed catalogues and preserve image revocations
• 513f0a3 feat: verify and cache signed distribution images
• 54638a1 fix: anchor catalogue policy to first public publication
• 510d94b fix: describe package inventory contents accurately
• 8fda8d3 fix: isolate image job from inherited Go installation
• 08bc3ce fix: verify download write recovery and include dependency notices