chore: release 0.3.0

[kevinccbsg]

Summary

• Bumps package.json and lockfile to 0.3.0 so a release tag can be cut after merge.
• Adds a CHANGELOG entry documenting the dep updates from chore: bump deps (ajv 8.20, ajv-formats 3, vitest 4.1.5, ref-parser, path-to-regexp) #2 — surfaces the only user-visible behavior change (ajv-formats v3 now rejects date-time/time strings without a timezone) and notes the fast-uri advisory closure.

Minor bump (not patch) is the right call because of the ajv-formats major: a strict OpenAPI spec that previously accepted timezone-less date-time values will now reject them.

Test plan

• CI green on the dep-update PR (chore: bump deps (ajv 8.20, ajv-formats 3, vitest 4.1.5, ref-parser, path-to-regexp) #2) before this release prep
• Cut a GitHub release tagged v0.3.0 after merge — the publish workflow handles npm publish