Release Drift v0.3.0 — Docs, Hardening & Live E2E · lilcipherx/drift

Changed

GitHub Action runs the CLI from its own checkout (node packages/drift-cli/dist/cli.js, dist/ committed, npm ci for workspace links) instead of npx -y @drift/cli — the Action works today, before any @drift/* package is published.
Code of Conduct (Contributor Covenant v2.0, enforcement contact = the repo owner) added and linked from README + CONTRIBUTING.
New docs: docs/quickstart.md (5-minute start), docs/api.md (full CLI reference: commands, flags, exit codes, JSON schemas, config.toml, env + MCP tools), docs/architecture.md (packages, storage, encryption at rest, webhook app, security model) — surfaced from the README top.
CONTRIBUTING/SECURITY/PR template refreshed: layout lists drift-app, security scope includes the webhook server, drift-crypto misnomer fixed (crypto lives in drift-core).
drift-app dev/start honor GITHUB_API_BASE_URL for local-mock testing.

CLI fuzz hardening: drift <unknown> --json emits a machine-readable JSON error instead of leaking the plain-text usage banner; all JSON output parses, no stack traces on any input (spaces, quotes, $(), unicode, tabs, newlines, long paths, garbage --line/--limit).
Path containment extended to symlinks/junctions: the realpath guard in drift blame/context also blocks a link inside the repo pointing outside — before any filesystem read. Positive cases keep working.
drift-app dev --dry-run actually dry: readOnly on the handler builds the summary (action: "dry-run") with zero writes; previously it posted the comment and created a check run.

Live webhook-server E2E suite (tests/app/live-server.test.mjs): real server + real GitHubAppClient (RS256 JWT) against a local mock GitHub API — opened/reopened, Link-header pagination (150 commits, trailer only on page 2), synchronize idempotent PATCH, repeated-delivery idempotency, missing installation.id, missing intent object → commit-subject fallback, PR without Drift-Intent trailers, bad HMAC, 9 MB body → 413, /health.
scripts/publish-npm.sh — one command to publish the @drift/ast → @drift/core → @drift/cli → @drift/mcp chain, confirm each version, and verify the npx -y @drift/mcp handshake from an empty directory.
Fixed @drift/cli main field and added the mcp bin entry to @drift/mcp so npx -y @drift/mcp resolves once published.

95/95 green (unit, temp-git-repo integration, MCP e2e, app unit + live webhook E2E).