Release v0.1.0-beta.3 (#47)

## Why
Ship the `snapshot()` crash fix (#46) to npm. Every earlier version, `0.1.0-beta.2` included, crashes Node when a JS accessor on `Object.prototype` disposes the terminal while `snapshot()` builds its result.

## What changed
- `package.json` and `package-lock.json` go from `0.1.0-beta.2` to `0.1.0-beta.3`. The branch name matches the version, so `publish.yml` creates `v0.1.0-beta.3` after merge.
- The `release-changelog` workflow adds the CHANGELOG entry to this branch.
- beta.3 also ships #48 (tests only) and #49 (the raw native addon's `feed` now rejects typed arrays other than `Uint8Array`). The package exports only `createTerminal`'s module, which already rejected those values in JS, so neither gets a CHANGELOG line.
- The beta.2 `## Fixed` heading, which the changelog bot had joined to the previous bullet, is restored.

## Blast Radius
The merge publishes `0.1.0-beta.3` to npm under the `beta` dist-tag. `latest` stays on `0.1.0-beta.0`. Snapshot output is byte-identical to beta.2, as #46's verifier checked.

## Verification
- CI (linux-x64, linux-arm64, linux-x64-ubsan, macos-arm64) passes on head `3365375`. Codex code and security reviews are clean on that head.
- `prepare-release-changelog.mjs` reports `changelog-entry-exists`. `resolve-npm-publish-tag.mjs` prints `beta`. The remote has no `v0.1.0-beta.3` tag.
- An independent verifier built prebuilds, ran `verify:prebuilds` (loads `prebuilds/linux-x64`), packed, and installed into a scratch consumer: `0.1.0-beta.3` loads from `prebuilds/`, and 8 accessor cases that crash beta.2 exit 0. It passed the CHANGELOG at `da96287`.

---
_Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_

Author: ThomasK33

CHANGELOG.md

@@ -4,6 +4,11 @@ All notable user-facing changes to this package will be documented in this file.
 
 ## [Unreleased]
 
+## [v0.1.0-beta.3](https://github.com/coder/libghostty-vt-node/releases/tag/v0.1.0-beta.3) - 2026-10-30
+
+## Fixed
+- Prevent `snapshot()` from running arbitrary JavaScript (via accessors on `Object.prototype` / `Array.prototype`) while the native code holds the terminal handle. Snapshot result objects are now built with own data properties (`napi_define_properties`), and both `includeScrollback` and `includeCells` options are read before the disposed-terminal check, so a getter that disposes the terminal during that read throws "GhosttyVtTerminal has been disposed". Before, such a setter (for example on `row` or `text`) crashed Node with a segfault or an assertion abort, and such a getter aborted it on an assertion ([#46](https://github.com/coder/libghostty-vt-node/pull/46) by @ThomasK33).
+
 ## [v0.1.0-beta.2](https://github.com/coder/libghostty-vt-node/releases/tag/v0.1.0-beta.2) - 2026-10-30
 
 ## Added

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@coder/libghostty-vt-node",
-  "version": "0.1.0-beta.2",
+  "version": "0.1.0-beta.3",
   "description": "ABI-stable Node-API bindings for Ghostty libghostty-vt terminal semantics.",
   "license": "MIT",
   "engines": {