v0.3.1

Nothing breaking.

A hostage budget on a singleton can pin its node: Karpenter checks budgets
before consolidating, drifting or expiring a node and simply never begins
while disruptions are not allowed, producing no signal anything could
react to. This release names that tradeoff in the README and makes it
visible per workload. A new watcher follows the DisruptionBlocked events
the blocker leaves behind and, when the named budget is one this operator
owns, raises a NodePinned condition on the affected Understudy, with a
Warning event and an understudy_node_pinned_total counter. The condition
clears when the refusals stop. Detection only, on by default
(signals.pinDetection in the chart): a pinned node is reported, never
resolved. The tradeoff section in the README lists the mitigations; what
actually moves a pinned pod is rescheduling it, via a deploy, a rollout
restart, or deleting the node claim so a real drain starts.

Also fixes the cross-build make target, which duplicated the platform
flag the Dockerfile already carries and masked the resulting failure.

The image is now tagged to match the chart appVersion exactly (0.3.1, no
v prefix), so installs no longer need an image.tag override.

Upgrading:

helm upgrade understudy oci://ghcr.io/kylan11/charts/understudy \
  --namespace understudy-system

The image is built for arm64 and amd64.