v0.3.0

Summary

• Security/dependency maintenance release over v0.2.2.
• Clears Scorecard #70 by exact-pinning transformers==5.9.0 with CPU torch==2.6.0.
• Closes MCP-server Hono CVEs via hono 4.12.23 and documents current Scorecard deferrals.
• Includes compile cancel cleanup, YouTube transcript-api 1.2.x Docker override, and Dependabot minor/patch roll-forward.

Verification

• Tests: https://github.com/tuirk/Kompl/actions/runs/27084780379
• CodeQL: https://github.com/tuirk/Kompl/actions/runs/27084780176
• Scorecard: https://github.com/tuirk/Kompl/actions/runs/27084780394

Known limitations

• Scorecard #27 branch-protection remains open by design for solo-maintainer policy gaps.
• Chroma/numpy migration remains deferred (chromadb==0.4.24, numpy<2).