[aaraujo]

Prepares the 0.3.0 release of packdb-cli. This changes no code.

• crates/packdb-cli/Cargo.toml: version 0.3.0, and packdb-client = "0.3.0".
• SDK_COMMIT in oss-ci, oss-candidate, oss-security and oss-publish moves from 522c0d951a, an untagged main commit, to 2fa68dd3ac773bbcfc1d0ef074bc10a19cca97a9, the SDK's v0.3.0 tag. Between the two, the SDK changes only version numbers and docs.
• Cargo.lock: only packdb-cli, packdb-client and packdb-otel change, from 0.2.4 to 0.3.0.
• CHANGELOG.md: "Unreleased" becomes "0.3.0", and the bullet that listed the SDK changes this release needs now names SDK 0.3.0.

Why 0.3.0

The release is breaking: packdb-query is retired in favour of packdb, and the flags, environment variables, default endpoint and exit codes changed (see the changelog). Before 1.0, a breaking change takes a minor bump, as SDK 0.3.0 did.

Release scope

Source only. publish = false stays, and no binary archives are built; how the packdb binary is distributed is decided separately. Tagging and the GitHub Release follow this PR and the release candidate built from its merge commit.

Local checks

With the sibling SDK checkout at v0.3.0 (2fa68dd), OSS_CHECK_SCOPE=full scripts/oss-ci.sh candidate on this commit exits 0:

• checks: policy, action pins, the client dependency check, fmt, clippy, rustdoc, the test matrix (66 test binaries, none failed; process.rs 19/19) and package contents;
• coverage passes at 80% per file; the lowest are src/main.rs at 89.1% and src/smoke.rs at 88.7%;
• cargo audit over 314 crates; cargo deny reports bans, licenses and sources ok; gitleaks finds no leaks;
• the release record shows version 0.3.0, SDK source 2fa68dd and publication disabled, and its checksums verify.