v0.3.0 — Cover that runs as a deployment

Three attestors and the API now run on a server of their own, and a compromise
of a protocol's admin key is paid out by those attestors alone, in seconds, with
anyone able to watch.

Details

• Against the hosted attestors on devnet (2026-10-09): 10 of 10 reproduced
  compromises paid out, one incident per event, slowest cycle 4.2s (was ~20s at
  v0.1.0); the declared-maintenance control was left alone
• The vote that completes the quorum carries the payout in the same instruction
  (FR-012)
• p95 confirmation -> payout 10s over 20 runs, $0.006 in fees per incident
  (were 12s and $0.008)
• The app and the landing page read real devnet data through a public read-only
  API; /health shows how far each attestor has looked and goes red when one
  falls silent
• Attestors pick up newly registered protocols without a restart; an event from
  before a policy began is not covered
• mandate-declare CLI: a covered protocol submits, narrows and revokes its own
  declarations
• devnet:compromise:hosted reproduces the run with no workers of its own

What is not here yet
The capital and the policies are ours; every attestor is run by us and stakes
nothing; no mainnet, no external audit.

Migration
New Postgres cache since v0.1.0: run pnpm --filter @mandate/db db:migrate
(with DATABASE_MIGRATION_URL) before starting the API on a fresh deployment.
The existing deployment is already migrated.