chore(release-please--branches--release-please--branches--release-please--branches--main): release 0.3.0

[openbao-operator-release-pr]

🤖 I have created a release beep boop

0.3.0 (2026-05-19)

Features

• openbaocluster: add ingress integration readiness (#409) (945b4a4)
• openbao: improve PKCS#11 runtime ergonomics (#400) (f32a6ec)

Bug Fixes

• backup: record manual triggers and failure time (#407) (ff172c6)
• config: align audit device options with OpenBao (#423) (b1ed4a3)
• config: harden generated JWT roles (#420) (546c6db)
• config: use SemVer precedence for OpenBao version checks (#394) (173847d)
• deps: restore dependency update CI coverage (#399) (032e1b7)
• gateway: emit TLSRoute as Gateway API v1 (#429) (05177d3)
• helm: deduplicate generated RBAC labels (#414) (78f8d73)
• openbao: share JWT token cache (#419) (a4a0887)
• provisioner: support external tenant PSS label ownership (#428) (08462c9)
• rbac: allow verification pull secret reads (#427) (10d40c0)
• restore: harden restore job rendering (#405) (3e52f5a)
• storage: retry transient S3 bucket ensure failures (#408) (9796c2c)
• upgrade: harden rolling upgrade resume (#406) (33fe59d)
• workload: mount OCI plugin directory (#421) (fc95717)

---

This PR was generated with Release Please. See documentation.

[dc-tec]

Closing this recursive release-please PR. It was created because main did not yet exclude release-please--branches--* branches from the Release Please workflow. Keeping #395 as the real main release PR.