chore(release): prepare v0.0.3

[StringKe]

Summary

• bump the repository release version from 0.0.2 to 0.0.3
• generate the 0.0.3 changelog from the security hardening merged in PR fix(security): close remaining scan alerts #69

Verification

• mise exec -- pnpm run check: PASS
• mise exec -- pnpm test: PASS
• git diff --check: PASS
• release contract: package version 0.0.3 matches changelog section 0.0.3

After this PR is Squash merged and the resulting main workflows pass, an annotated v0.0.3 tag will trigger the least-privilege Release workflow.