docs(release): prepare v0.0.3 notes and changelog

Author: rldyourmnd

CHANGELOG.md

@@ -12,6 +12,28 @@ The format is based on Keep a Changelog and this project follows Semantic Versio
 
 ### Removed
 
+## [0.0.3] - 2026-03-02
+
+### Added
+
+- Dependency review workflow for pull requests (`.github/workflows/dependency-review.yml`) with `moderate` vulnerability threshold.
+- Repository `Makefile` quality targets (`check`, `lint-shell`, `syntax-shell`, `lint-workflows`, `lint-docs`, `smoke`).
+- Development quality guide (`docs/development.md`).
+- Markdown lint baseline config (`.markdownlint.yml`, `.markdownlintignore`).
+
+### Changed
+
+- CI workflow hardened:
+  - `actions/checkout` pinned to SHA for `v6.0.2`.
+  - Added workflow lint (`actionlint`) and docs lint (`markdownlint`).
+- Contribution flow now documents mandatory local quality gate (`make check`).
+- README and docs index now include contributor quality checks and development guide links.
+- Documentation commands now use portable paths (`~/projects/new-macos-dev-setup`) instead of user-specific absolute paths.
+- Issue form placeholders updated to realistic macOS version examples.
+- `.gitignore` now excludes local Codex/agent metadata directories (`.serena/`, `.claude/`, `.codex/`).
+
+### Removed
+
 ## [0.0.2] - 2026-02-25
 
 ### Added

docs/release-process.md

@@ -23,8 +23,8 @@
 
 ## Active release target
 
-- `v0.0.2`: complete macOS setup baseline with full program coverage and configuration defaults.
-- Planning source: `docs/roadmap-v0.0.2.md`.
+- `v0.0.3`: OSS hardening release (CI security, dependency review, contributor quality gates, documentation portability).
+- Planning source: `docs/releases/0.0.3.md`.
 
 ## Cut release
 

docs/releases/0.0.3.md

@@ -0,0 +1,94 @@
+# Release 0.0.3
+
+## Release date
+
+2026-03-02
+
+## Scope
+
+This release hardens repository operations for open-source maintenance while preserving the full macOS bootstrap stack from previous releases.
+
+## What works now
+
+### Production bootstrap remains intact
+
+- Entrypoints:
+  - `./install-macos.sh`
+  - `./scripts/bootstrap/bootstrap.sh`
+  - `./scripts/bootstrap/setup-macos-dev-stack.sh`
+- Supported profile: macOS (`darwin`) with modular installation flow.
+- Linux placeholder flow remains executable for smoke testing (`--os linux`).
+
+### Full module coverage (unchanged runtime stack)
+
+- System tools
+- Terminal UX (Starship, Atuin, delta)
+- Containers (OrbStack, Docker, Colima)
+- Kubernetes toolchain
+- Java (`openjdk@17`)
+- JS/TS (Bun + Node 24 policy)
+- Python (`3.13` default, `3.14` additional)
+- Rust toolchain + cargo quality tools
+- Flutter/mobile stack
+- C/C++ toolchain
+- AI CLI stack (Claude, OpenCode, Gemini CLI, Codex)
+
+### CI and security improvements
+
+- `CI` workflow now pins `actions/checkout` to commit SHA (`v6.0.2`).
+- Added `workflow_lint` job (`actionlint`).
+- Added `docs_lint` job (`markdownlint-cli`).
+- Added `Dependency Review` workflow on pull requests with:
+  - `actions/dependency-review-action@v4.8.3` pinned to SHA
+  - `fail-on-severity: moderate`
+
+### Contributor experience improvements
+
+- Added `Makefile` quality gates:
+  - `make check`
+  - `make syntax-shell`
+  - `make lint-shell`
+  - `make lint-workflows`
+  - `make lint-docs`
+  - `make smoke`
+- Added `docs/development.md` to document local CI parity workflow.
+- Updated `CONTRIBUTING.md` to require local quality checks before PR.
+
+### Documentation and hygiene improvements
+
+- Portable docs commands now use `~/projects/new-macos-dev-setup` instead of user-specific absolute paths.
+- Issue form placeholders updated to realistic current macOS examples.
+- `.gitignore` now ignores local agent metadata directories:
+  - `.serena/`
+  - `.claude/`
+  - `.codex/`
+
+## Validation summary for this release
+
+Validated locally on repository state before tagging:
+
+- shell syntax checks (`bash -n`) passed.
+- shell lint (`shellcheck`) passed.
+- workflow lint (`actionlint`) passed.
+- docs lint (`markdownlint`) passed.
+- smoke entrypoint checks passed, including Linux placeholder execution.
+
+## Operator commands
+
+### Run full local quality gate
+
+```bash
+make check
+```
+
+### Run smoke checks only
+
+```bash
+make smoke
+```
+
+### Standard install
+
+```bash
+./install-macos.sh --start-orbstack
+```