release: bump workspace to v0.3.0

[mlieberman85]

Summary

Cuts a stable v0.3.0 — 43 commits since v0.2.0, substantial feature surface.

Feature highlights

Resolvers + graph completeness

• m663 (feat(m663 US1 MVP): local-cache-probe resolver — Maven + Go (C152) #708, feat(m663 US2): cache-probe — Cargo + RubyGems #709, feat(m663 US3): cache-probe — npm + Python probes with metadata reads #710, feat(m663 Polish): SC-003/SC-005/SC-006 tests + close-out (closes #605) #712) — Local cache-probe resolver reading `/.m2`, `$GOMODCACHE`, `/.cargo`, RubyGems, npm, pip caches for high-confidence PURL extraction without network. New C152 `waybill:resolver-tier` doc-scope annotation.
• m235 (feat(m235): Gradle transitive dep-graph ladder — Phase 3 US1 subprocess #688-feat(m235 US4 follow-on): per-component gradle-platform-import (C150) #701) — Gradle transitive dep-graph ladder (subprocess → cache → static → lockfile-only). C146-C150 doc-scope + per-component annotations.
• m236 (feat(m236 US1 MVP): universalize waybill:unresolved-reason (C151) for maven/npm-walk/pip #703-feat(m236 Polish): cross-reader integration test + close-out (closes #659) #706) — Universalize `waybill:unresolved-reason` (C151) across all design-tier readers.

Architecture

• m664 (feat(m664): single-pass walker — 21+ reader migrations, ~5× perf #715) — Single-pass filesystem walker consolidates 21+ ecosystem-reader walk sites into one tree traversal per scan. 5-6× warm-cache perf improvement on large fixtures.
• m665 (feat(m665): --no-binary-scan flag for fast large-tree scans #719) — `--no-binary-scan=` flag for operator opt-out of Go-binary content probing. C153 `waybill:binary-scan-suppressed` doc-scope annotation across CDX / SPDX 2.3 / SPDX 3.

eBPF

• m234 (feat(m234): durable eBPF build resilience (composite action + canary + verify script) #682, feat(m234 US1b): un-pin bpf-linker to 0.11.0 via pre-built binary install #686) — Un-pin bpf-linker to 0.11.0 via pre-built binary install + composite action + daily canary + verify script.

Fixes

• fix(ebpf): verifier-friendly bound in tls_openssl::probe_ssl_read #711 — Verifier-friendly bound in `tls_openssl::probe_ssl_read` for kernel bumps.
• fix(233): scope Go graph resolver dependsOn edges per main-module #680 — Go workspace-mode detection in `mod_why` preflight.
• fix(release.yml): pin cosign legacy bundle format #674, fix(release.yml): switch cosign sign-blob to --bundle output #675, fix(release.yml): add skip_ebpf workflow_dispatch input #681 — release.yml + cosign compatibility fixes.

Golden regeneration

Regenerated via `WAYBILL_UPDATE_CDX_GOLDENS=1 WAYBILL_UPDATE_SPDX_GOLDENS=1 WAYBILL_UPDATE_SPDX3_GOLDENS=1 cargo test --workspace --no-fail-fast`.

• CDX: 11 files, 1-line churn each (`metadata.tools[].version` bumped 0.2.0 → 0.3.0)
• SPDX 2.3: 11 files — version string cascades into content-addressed `SPDXRef-DocumentRoot-*` IDs and `documentNamespace` URLs (both content-hashed)
• SPDX 3: 11 files — same content-addressing cascade into `doc-`/`pkg-`/`anno-`/`rel-` IRIs

Also updates `waybill-cli/tests/fixtures/pkg_alias_binding/image-baz.cdx.json` (same one-line version bump on an out-of-tree regression fixture).

Verified: normalized+sorted diff on all 33 goldens shows zero semantic change beyond the version string per project memory `feedback_verify_golden_churn_normalized`.

Test plan

• `cargo update -p waybill -p waybill-common` — Cargo.lock refreshed
• Golden regen via env-var-driven `cargo test --workspace --no-fail-fast` → exit 0, aggregate 0 failed
• Normalized+sorted diff on all 33 goldens: clean (only version-string churn + content-addressed ID cascade)
• CI: full workspace test + clippy (skipping local pre-PR per project memory `feedback_release_bump_prepr_slow` — version bump invalidates the full compile cache; CI will verify in ~5 min)

Post-merge

Manually tag + push on the merged commit (auto-tag-release.yml was retired in m229):

```sh
git checkout main
git pull
git tag v0.3.0
git push origin v0.3.0
```

`release.yml` triggers on the tag push → GitHub release with artifacts + cosign-signed source SBOM.

🤖 Generated with Claude Code