v0.3.0 — audit remediation (22 fixes)

Highlights

• crt.sh was always returning 0 subdomains. It reads name_value (newline-separated SANs), not value_names. The subdomain signal now works.
• apex_of no longer returns a subdomain for multi-label suffixes (.com.mx, .co.uk, …).
• Common Crawl errors are no longer cached as if they were real 0-hit results (purged 300 poisoned state.db rows).
• Wayback circuit breaker is now module-global, so it actually trips.

Fixed

• GUI: flagged_by exported from rowOf, filter no longer throws
• Common Crawl: retry transient failures before reporting an error
• Reputation: reputation_error surfaced end-to-end instead of scoring a silent 0
• State.trend(): batched scores lookup (was N+1 per domain)
• Dossier: removed write-only enrich_put cache entry
• run_scores keys renamed to crawler / subdomain_score (DB columns unchanged)
• Single report.csv_row serializer shared by the GUI export
• httpstatus splits up (<=399) from responding (<500)
• Removed dead v1 code, dead run() params, and the no-op --strict-expired
• Self-update: _looks_like_app payload guard + Python 3.11 extractall branch

Tooling / docs

• Ruff dev dependency, README, and AGENTS.md rewritten to the v3 traffic-footprint pipeline
• Version bump 0.2.9 -> 0.3.0

Verification: 162 passed, 4 deselected; ruff clean.