v0.3.1

A patch rather than a minor: nothing here changes what a bundle means, and the
two behaviour changes below correct a feature that shipped in 0.3.0 hours
earlier.

It exists because the fixes under Fixed were sitting in main and not in
the version anyone could install — the same gap 0.3.0 was cut to close, on a
scale of hours rather than a week. Three of them are places a subject could act
on the evidence about itself, which is the defect this project treats as the
worst it can ship.

Fixed

• The run's bearer token could be written through a symlink. The MCP host
  config is 0600 because that token is the only thing between another local
  account and the scenario's tool façade, beacon_submit included — but the
  open had no O_NOFOLLOW, and the account that mode defends against is
  exactly the one that can plant a symlink at the path first.
• Two handshakes could erase a run. A structure nested past what
  dataclasses.asdict can walk takes RecursionError out through the evidence
  write, after the subject has already acted. serverInfo and clientInfo
  were not bounded, and both feed SubjectResult.metadata.
• A truncated artifact's name could become a link in report.md. The
  limitations list neutralised line endings and raw HTML; markdown's own link
  syntax passed through.

Changed

• A probe now releases the session it opened, with a DELETE on close.
  Best effort: DELETE is a SHOULD, a stateless server answers 405, and
  teardown never raises.
• mcp-inspect --timeout left unset now means each transport's own default
  — 10 for --command, 20 for --url — rather than 10 for both.

The full entry is in
CHANGELOG.md.

---

Verified before publishing, at e7644d3:

• 1081 tests on CPython 3.11.14 and 3.13, zero ResourceWarnings
• 420/420 adversarial subject verdicts correct
• 121 recorded site fixtures reproduce
• the shipped test suite run from inside the unpacked sdist
• the wheel installed into a clean virtualenv and run from an empty directory