Summary

Prepares the documentation side of the 0.3.0 release:

• adds the handwritten release-notes/0.3.0.md operator-facing release note
• snapshots the 0.3.0 Docusaurus docs version and updates website/versions.json
• updates generated release pages so older 0.2.0 release notes link to /docs/0.2.0
• clarifies upgrade JWT auth docs so selfInit.oidc is described as initial bootstrap only, not a retrofit path for running clusters

This is intended to satisfy the stable X.Y.0 docs snapshot requirement before the release-please 0.3.0 PR is merged.

Related Issues

Related to #395.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactor (code improvement/cleanup)
• CI, release, or build tooling
• Other maintenance

Risk and Compatibility

Low runtime risk. This PR does not change controller behavior.

API-facing impact is limited to generated CRD/API documentation text and the validation error message for unsupported spec.upgrade.tokenSecretRef; the validation rule itself remains unchanged. The release docs call out upgrade caveats for inline auth, audit file storage, restore token identity labels, stricter storage endpoint validation, metrics-only listeners, Gateway passthrough, PKCS#11 runtime wiring, and OCI plugin downloads.

Verification

• make docs-version DOCS_VERSION=0.3.0
• make docs-refresh-version DOCS_VERSION=0.3.0
• make manifests generate api-reference
• make helm-sync
• npm --prefix website run verify:docs-version -- 0.3.0
• npm --prefix website run test:e2e
• make verify-generated
• make verify-helm
• make docs-build
• git diff --check origin/main...HEAD
• pre-push hook: make lint-ci

Reviewer Notes

The handwritten release note intentionally excludes perf harness work from the narrative because that work is test/release confidence infrastructure, not a production feature or fix. Release-please may still include perf-related conventional commits in the generated changelog unless the generated changelog policy is changed separately.

After this merges, the current release-please PR should be refreshed/rebased so the final 0.3.0 release PR includes the docs snapshot and manual release note.

Checklist

• My code follows the project style guide.
• I have performed a self-review of my own code.
• I have added or updated tests, or explained why tests are not needed.
• I have updated documentation, or explained why docs are not needed.
• I have updated generated artifacts, or confirmed none are affected.
• I have checked that this change does not log or expose secrets, tokens, credentials, keys, or raw Secret data.
• I have run the relevant local checks, or documented why they were not run.
• Any dependent changes have been merged, published, or clearly called out.