v0.3.0

[0.3.0] - 2026-05-19

Added

• Real-AWS acceptance test suite (tests/acceptance/) — 92 opt-in tests
  covering 100% of the registered MCP tool surface against a provisioned
  fixture account. Gated by pytest -m acceptance / --override-ini='addopts='
  so bare pytest deselects.
• Acceptance-level safety tests for the MCP error envelope shape, the
  AwsAuthError account guard at startup, and the redaction invariant
  on Lambda environment variables (only keys, never values, ever leave
  get_lambda_summary).
• Local CI gate (scripts/ci_local.py + .githooks/pre-push) that mirrors
  .github/workflows/ci.yml step-for-step. Activate per clone with
  git config core.hooksPath .githooks.

Fixed

• 40-char secret-access-key redaction regex now matches secrets that
  start or end with /, +, or =. The previous \b word boundary
  silently failed when both sides of the boundary were non-word
  characters, allowing some shapes of AWS secret access keys to escape
  redaction in normalize_aws_error output.

Security

• Bump transitive dep idna 3.13 → 3.15 to close CVE-2026-45409 (high).