Release 0.3.0

[folded]

Version bump 0.2.0 → 0.3.0 (pyproject.toml + uv.lock).

Bundles the workspace reference-closure work and the host-escape fix:

• Give the caller-owned workspace the sticky bit (0o1777) #4 — give the caller-owned workspace the sticky bit (0o1777), so the guest can't unlink/replace host-written files to swap in an escaping symlink.
• Reference-closed workspace accessor (Workspace/WorkspacePath) #6 — reference-closed workspace accessor: Workspace/WorkspacePath (a confined root, per-component O_NOFOLLOW), pack_tar/restore_tar (→ WorkspaceReport), reference_closed_filter, Sandbox.accessor(). The host reads/packs/restores a workspace without following any guest-planted symlink, .., escaping hardlink, or special file out of the tree.
• Mask the procfs sysctl surface read-only (host escape via core_pattern) #8 — critical host-escape fix. bwrap's fresh --proc re-exposed the procfs sysctl surface writable; a guest whose mapped kernel uid is root could write core_pattern/modprobe and gain init-namespace root. /proc/sys (+ /proc/sysrq-trigger, /proc/irq, /proc/kcore, …) are now re-masked read-only. Validated in Docker (before: core_pattern writable → root handler runs; after: EROFS).
• Follow-ups: opt-in non-root bwrap + block io_uring #9 — defense in depth: SandboxProfile(host_uid=…) opts bwrap into running at a non-root real uid (so the guest's kernel uid owns none of root's files); io_uring_setup/enter/register added to the seccomp denylist.

Minor bump: additive public API (accessor, host_uid/host_gid) plus security fixes, no breaking changes.