v0.3.0

180a969 test(rename): make TestRollback case-insensitive-FS safe
edfea19 Merge branch 'improve/toolchain-ci-parity'
00c071f docs: release v0.3.0 (Go 1.25 note, release verification)
31ec682 docs: changelog for unreleased CI/toolchain parity
9b6bb8e ci(release): checksums + keyless cosign signing; bump actions
743086f ci: add lint, govulncheck, gofmt check across OS matrix; dependabot
2a1787b build: bump Go toolchain to 1.25
896cb56 refactor(refs): use strings.ReplaceAll (staticcheck QF1004)
1b416fa style: gofmt internal/cmd/init.go and internal/policy/policy.go