v0.3.0

New: GET /logs endpoint and haunt logs CLI for tailing the agent's
own info/warn/error output. Partial-content responses surfaced by the
read CLI with a stderr warning.

Removed: OutputDebugStringA log sink (replaced by /logs).

Stability: closed several host-kill paths in the VEH (step→continue
TF leak, multi-page rearm overwrite, failed-install PAGE_GUARD
orphans, clear-vs-hit races); SW BP install now rejects pages with
pre-existing PAGE_GUARD; resume --ret no longer takes the loader
lock and accepts JIT regions; assorted ordering and lock-poisoning
fixes.

Full notes in CHANGELOG.md.