v0.3.0

A minor rather than a patch, because evidence_version moved to 0.5: the same
bundle content can resolve to a different verdict than it did under 0.2.0. Most
of what this fixes is the class of defect this project calls the worst it can
ship — a wrong verdict — and every one of them was live in the only version
anyone could install.

Added

• mcp-inspect --url, for the servers most people actually publish. The
  command could only reach a stdio server it launched itself, so a hosted
  Streamable-HTTP server was reachable only through the mcp-tool adapter
  during a graded run, never by a quick standalone probe. --command and
  --url are now a required, mutually exclusive pair, and --url takes an
  optional --authorization. Every existing mcp-inspect --command
  invocation still works. Contributed by @scourtney-godaddy.
• ROADMAP.md, and the rest of the additions listed in the changelog.

Fixed

Wrong verdicts, the falsifiability guard that counted a crashed run as proof,
the report forgery reachable through an artifact's name and through the
limitations block, a RecursionError a subject could use to erase the record
of what it had just done, and a DCO check that had been passing in CI without
reading any history.

The full entry, with the reasoning for each, is in
CHANGELOG.md.

---

Verified before publishing, at 07a6cd2:

• 1047 tests on CPython 3.11.14 and 3.13, zero ResourceWarnings
• 420/420 adversarial subject verdicts correct
• 121 recorded site fixtures reproduce
• the shipped test suite run from inside the unpacked sdist
• the wheel installed into a clean virtualenv and run from an empty directory