chore(release): prepare 0.1.0-beta.3

[Baskerville42]

Summary

Prepare @udid-tools/core 0.1.0-beta.3 for release.

This updates package and documentation version references, records the accumulated beta.3 changes, adds consumer-facing release-integrity instructions, and keylessly signs and verifies every GitHub Release asset with Sigstore. The existing checksum, CycloneDX SBOM, GitHub artifact attestation, npm provenance, and exact-tarball publishing controls remain in place.

Change type

• Bug fix
• Feature
• Documentation
• Refactor with no intended behavior change
• Dependency or build tooling
• Security hardening

Public API and compatibility

Public API impact: None. This release-preparation change does not alter exports, types, defaults, validation, or serialized bytes.

• The change is backward-compatible with the documented beta API.
• User-visible behavior is documented and listed in CHANGELOG.md.
• A migration note or ADR is included when the compatibility impact is material.

Security review

• I reviewed THREAT_MODEL.md and preserved its security invariants.
• The change introduces no implicit network, filesystem, environment, logging, or background-task behavior.
• Errors, warnings, fixtures, and snapshots contain no production secrets or real device data.
• New or changed untrusted-input paths have negative and resource-limit tests.
• New dependencies are justified below and do not require an unreviewed install script.

Dependency justification

No package dependency was added. The release workflow adds sigstore/gh-action-sigstore-python v3.5.0, pinned to the full commit SHA, to create and immediately verify keyless Sigstore bundles for every release asset.

Verification

• npm run verify
• Relevant examples compile and use the current API.
• Tests use only disposable synthetic identities and sanitized fixtures.
• npm audit --audit-level=high
• npm audit signatures
• Packed-tarball clean-consumer smoke test
• GPG signature on the release-preparation commit verified locally

Results: 104 tests passed; coverage remained above all 90 percent gates; documentation built with zero errors, warnings, or hints; npm audit found zero vulnerabilities.

Documentation and references

• Sigstore GitHub Actions signing: https://github.com/sigstore/gh-action-sigstore-python
• OpenSSF Scorecard Signed-Releases check: https://github.com/ossf/scorecard/blob/main/docs/checks.md#signed-releases

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!