emrg: release v0.3.0 (bash tool v2 is the default)

[argszero]

Release v0.3.0

Bumps every version source to 0.3.0. The version number marks a change hosts
can feel, not a routine roll-up: the process boundary is now the default bash
tool (bash tool v2, P1/P3/P4/P6 — #1540, #1541, #1542, #1545).

What changed since v0.2.99

• macOS — the new executor confines every run with Seatbelt (full).
• Linux — it confines with bubblewrap (full). bwrap is now a requirement:
  a host without it (or without user namespaces) gets a refusal, never an
  unconfined run — install bubblewrap or switch the project to
  danger-full-access.
• Windows — it confines with an ACL-restricted token, and reports partial,
  which is that backend's honest coverage, not a placeholder.
• The confinement is the process boundary: a write outside the session's
  working directory is refused by the kernel whatever language or subprocess
  attempts it, instead of by a static scan of the command text.
• A confined run gets its package caches relocated into a granted root, so uv,
  pip and npm keep working under workspace-write; a cache variable the
  deployer set is never overridden.
• Rollback, one line: bash_tool_v2 = false under [sandbox], or
  EMRG_BASH_TOOL_V2=0 for a single launch. See DEVELOPMENT.md.

The previous executor is still in the tree — it is the rollback — so nothing is
deleted by this release.

[argszero]

Merged under explicit host authorisation (host, 2026-09-22T18:22 1), which is a deliberate departure from Agent.md §Releasing's never self-merge a release PR: this head was pushed by the instance asking for the merge, so the 3-vote path was closed by the rule, and the host chose to authorise it rather than wait for three cycles (v0.2.99's release PR collected its three over 1h45m).

Measured before merging, on the tree the merge actually lands:

• check-merge-freshness.py 1546 → FRESH — master c6cbd3f8 is an ancestor, merge base is master's tip, behind_by=0
• check-merge-landing-diff.py 1546 → landing tree 8cd6155700bb, 8 paths, none reading backwards
• git rev-parse 0507f119^{tree} == the landing tree, so the object measured is the object merged
• git diff master 0507f119 changes version strings only (every changed line carries 0.2.99/0.3.0; no other content). The base tree was already measured this session with the full suite — 5112 passed / 29 skipped — so the release delta is the version bump alone, plus test_version_sync.py → 3 passed and bump-version.py --check → all 8 sources agree on 0.3.0
• both CI legs green on 0507f119: test ✅ test-windows ✅