v0.3.0

Added

• (xmldsig) [breaking] split verification from signing (#320)
• (api) [breaking] bind Rust operations to policy (#267)

Documentation

• qualify public API and migration guides (#271)

Fixed

• (xml) charge only declared entities to the expansion ceiling (#312)
• (cli) select the encrypted node in --xml-data (#300)
• (xslt) skip unused function registry setup (#288)
• (interop) make corpus execution reproducible (#285)

Performance

• (bench) compare against competitors at CLI and library level (#314)
• (xmlenc) decrypt without redundant document parses (#307)
• (xmldsig) sign without reparsing each step (#305)
• (xslt) resolve per-call static work once (#297)
• (xslt) add phase and reuse measurements (#260)

Refactored

• (key-manager) [breaking] read PKCS#12 with the shared reader (#323)
• (security) [breaking] qualify orchestration lint (#294)
• (xslt) qualify compiler and runtime (#293)
• (xml) [breaking] qualify kernels and group ci (#289)
• (pkix) [breaking] use shared spki framing (#283)

Documentation

• Add executable policy-bound and low-level API examples, expected-target
  verification, schema v1 reference, restrictive deployment runbook and
  libxmlsec1 migration guide.
• Document provider capability and compatibility boundaries without claiming
  C source/ABI compatibility or a 1.0 release. The policy-bound facade and typed
  umbrella error changes after 0.2.0 remain unreleased until publication.