0.3.0 — sealed mobile native wrapping adapter

Adds the sealed secure_data::providers::mobile::MobileKeyProvider<B> behind mobile-storage, with SDK-only iOS Keychain and AndroidKeyStore wrapping reference sources. Reuses envelope encryption; long-lived KEKs remain native. Other crate APIs retain their behavior under the coordinated 0.3.0 family version.

Use the mobile migration guide. The supplied references have real simulator/emulator restart, tamper and deletion evidence. Consumer FFI/cancellation, physical-device custody and Guardian reconciliation require separate qualification. iOS requires WhenPasscodeSetThisDeviceOnly, no fallback, and trusted re-enrolment after passcode removal/reset. Software custody does not satisfy hardware-required policy. DataError remains non-exhaustive and adds MobileKeyProvider { kind }.

Package source: e1f4506 (#135). Tag/approval record: 8f77c4d (#136). Twelve registry archives passed exact source/graph/provenance plus checksum-pinned official OSV admission before compilation/upload; downloaded registry bytes and VCS/checksums match. External dependencies/audits and exact expiring reachability exceptions are preserved; OSV does not prove absence of unknown malware.

Signing run 38627967780 verifies and signs immutable registry bytes in an isolated job. Verify each payload using its Sigstore bundle, identity https://github.com/kerberosmansour/SunLitSecurityLibraries/.github/workflows/release-sign.yml@refs/tags/v0.3.0 and issuer https://token.actions.githubusercontent.com. SHA256SUMS covers 27 payloads; twelve dependency SBOMs conform to CycloneDX 1.6. The capability declaration states tested limits.