v0.3.0

Sat provenance in both directions, on the same fail-closed trust model as content verification. Forward, custody proofs give an inscription's satpoint history from its reveal to its current location. Backward, sat identity proves which sat it lives on, traced to the coinbase that mined it. Galleries decode from the envelope, which puts membership inside the bytes a content proof already binds.

New commands: ord-resolve custody <id> prints the proven satpoint with hop count and per-source tip state, and ord-resolve sat <id> prints the sat number with its name, rarity, mining block, and walk depth. Both take --bundle FILE to write a verifiable artifact that ord-resolve verify re-checks offline. New flags: --timeout-ms on every network command and --max-steps on the sat walk. Specs for both directions are SPEC-CUSTODY and SPEC-SAT, with the shared anchoring rules in SPEC-VERIFICATION.

Three of the fixes in this release apply to published 0.2.x, where they weakened proof-bundle forgery detection. They are disclosed in GHSA-x6wp-x7q7-gwc6 and in docs/advisories/2026-08-04-verification-defects-0.2.x.md. The 0.2.x versions are deprecated on npm and there is no 0.2.x backport.

Upgrade all @ordspv/* packages together. Each pins its workspace dependencies to exactly 0.3.0, so a partial upgrade leaves the old core in place.

The full record of what changed, and why, is the 0.3.0 section of the CHANGELOG.