Cut the v0.3.0 release in the CHANGELOG

[PyYoshi]

Summary

Cut the v0.3.0 release in the CHANGELOG. The [Unreleased] entries move
under ## [0.3.0] - 2026-09-23, an empty [Unreleased] section stays on
top, and the compare links are updated ([Unreleased] from v0.3.0, and
a new [0.3.0] link against v0.2.2).

Why a minor bump: there are no exported API changes, but verdict handling
is stricter. Replies outside the exact OK allowlist (ADR-0005), OK replies
without their NUL terminator (ADR-0007), and truncated sources now fail
closed, so a non-conforming peer or source can turn a previously clean
scan into an error. In 0.x, a minor bump marks that as "review before
upgrading". The maintainer confirmed v0.3.0.

After merge: signed tag v0.3.0 and the GitHub release (release skill,
step 4).

Independent review

Codex adversarial-review approved the merged commit bbed855 with no findings; see the review record.

Checklist

• make verify passes locally (build + lint + tests)
• make integration passes (required when client.go / conn.go / commands.go / internal/proto/ / docker/ changed) — not run; only CHANGELOG.md changed
• README.md and README.ja.md updated together, or the change touches neither
• CHANGELOG.md updated under [Unreleased] for user-visible changes
• No new dependencies, no assembled EICAR string, no weakened guards; design changes reference an ADR
• Reviewed against the AGENTS.md Review checklist by someone other than the author, covering the merged commit (recorded in the PR); every finding fixed or answered

[PyYoshi]

Independent review record

Reviewer: Codex adversarial-review (separate from the authoring session), against the AGENTS.md Review checklist, the release skill and Keep a Changelog 1.1.0.

Round	Commit	Verdict	Findings
1	bbed855	approve	None. Checked that no entries were lost or duplicated, that an empty [Unreleased] stays on top, and that the date and compare links are correct. A minor bump is appropriate under SemVer 0.x, because stricter verdict handling is a behavioral compatibility change.

Reviewed commit for merge: bbed8558fd8a322615e0e9096415e7ac0c27e44d.