release: prepare v0.3.1

[vicotrbb]

Summary

• optimize shared sensitive-attribute key filtering with a one-pass first-byte dispatch while preserving the allocation-free ASCII substring contract
• add an exhaustive shared-fragment parity regression test
• correct the local whole-agent benchmark root and add a guarded homelab allocation diagnostic
• harden version preparation so product bumps cannot rewrite the independently pinned OTLP Profiles protocol module
• prepare every release surface for E-Navigator 0.3.1

Motivation and impact

The sanitizer microbenchmark and symbolized profile identify repeated sensitive-key scans as a hot path. This change keeps the public deny list and filtering behavior intact while reducing repeated comparisons. The full-stack homelab campaign did not prove an overall CPU/RSS improvement, so that historical NO-GO remains explicitly documented.

The release tooling fixes make the benchmark and version preparation workflows reproducible without altering capture contracts or security boundaries.

Validation

• scripts/quality.sh with no skip variables
• Rust formatting, strict Clippy, rustdoc, workspace tests, build, and fuzz-target compilation
• release contract for 0.3.1
• supply-chain audit, deny, and dependency hygiene checks
• Docker build and smoke tests
• Helm lint/render and Kubernetes schema validation
• documentation, website-link, secret-pattern, and repository diff guards
• focused Criterion confirmation for signal/sensitive_trace_key_checks

Release

After protected merge and required checks, tag the exact verified main commit as annotated v0.3.1. The tag-triggered workflow publishes and verifies signed multi-architecture images, the OCI Helm chart, SPDX SBOMs, checksums, Sigstore bundles, and the GitHub Release.