Harden DPoP verification and prepare 0.3.0

[jamestexas]

Summary

• harden DPoP proof validation, ath binding, URL normalization, key/alg checks, and stable errors
• make replay recording atomic and move worker token replay state into durable SQLite
• ship an npm README plus package-local MDX guides and packed-artifact smoke test
• add repo-relative hierarchical Taskfile release commands and prepare version 0.3.0
• track downstream Cloister, canonical-hours, and Socket follow-ups in rsry beads

Verification

• 65 DPoP package tests
• 373 Worker tests passing, 6 todo
• 20 Durable Object tests
• packed README/MDX/dist contract and extracted ESM import
• DPoP build, frozen lockfile, SHA-pin check, and Taskfile dry-run release gates
• independent implementation reviews approved

Release

This PR does not publish npm or push the local dpop-v0.3.0 tag. After merge, publish from updated main with task dpop:publish.