v0.3.0

What's Changed

• feat: add Rust secure-exec runtime library by @NathanFlurry in #53
• feat: configurable JS runtime platform (CreateVmConfig.jsRuntime) by @NathanFlurry in #78
• perf(sidecar): cut guest fs RPC latency (fs-heavy workloads 5.7–41× faster) by @NathanFlurry in #77
• fix(ci): resolve pnpm/action-setup version conflict by @NathanFlurry in #83
• Security review fixes (secure-exec) by @NathanFlurry in #79
• fix(example): native-client uses current CreateVmConfig (unblocks CI) by @NathanFlurry in #84
• Security hardening: chokepoint lint + default-deny/safe-default guards by @NathanFlurry in #85
• Security review: close coverage gaps (DNS rebinding, supply chain, builtin desync, browser isolation) by @NathanFlurry in #86
• style: rustfmt security-review additions (unblock cargo fmt --check) by @NathanFlurry in #87
• feat: opt-in wall-clock execution backstop (complements CPU-time budget) by @NathanFlurry in #89
• fix(clippy): resolve -D warnings lints in security-review code by @NathanFlurry in #90
• ci: pin rust toolchain (1.96.0) + fix clippy lints by @NathanFlurry in #93
• test: make env-dependent dns/abort-signal conformance robust on CI by @NathanFlurry in #94
• test: stabilize crash-isolation timeout (pre-existing flake) by @NathanFlurry in #95

Full Changelog: v0.2.1...v0.3.0