release: v0.3.0

Promote VERSION from 0.3.0-dev to 0.3.0. Finalise CHANGELOG entry with
phases 5-8 work (state machine + metrics, channels + maintenance windows,
OCI multi-arch distribution, pre-flight gates + deeper healthcheck +
auto-rollback). Refresh README quick-start to show both x86_64 and generic
ARM64 paths; update the roadmap status table to mark all v0.3 phases
complete and explicitly track the v0.3.1 follow-ups (OCI cosign,
LABEL=KSOLODATA on ARM64, real-hardware validation).

Add docs/release-notes-0.3.0.md as the operator-facing summary, including a
v0.2.x -> v0.3.0 migration section (non-breaking on live systems) and the
known-limitations list copied from CHANGELOG.

All tests green: cloud-init module, all 10 update-module packages,
shellcheck across init / build / test / hack scripts under the v0.3
severity policy.

Tagging is intentionally NOT done from this commit — that's a manual step
so the operator can decide when v0.3.0 is final. After tagging:

  git tag -a v0.3.0 -m "KubeSolo OS v0.3.0"
  git push origin v0.3.0

The push triggers .gitea/workflows/build-arm64.yaml which runs the full
ARM64 build on the Odroid runner.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -2,7 +2,7 @@
 
 An immutable, bootable Linux distribution purpose-built for [KubeSolo](https://github.com/portainer/kubesolo) — Portainer's ultra-lightweight single-node Kubernetes.
 
-> **Status:** x86_64 is stable — boots and runs K8s workloads, Portainer Edge Agent tested and connected. ARM64 generic UEFI is the active focus for v0.3.0; ARM64 Raspberry Pi support is paused pending physical hardware testing.
+> **Status (v0.3.0):** x86_64 and generic ARM64 (UEFI / virtio / mainline kernel) both build and boot end-to-end. Update agent has an explicit state machine, OCI registry distribution alongside HTTP, channel + maintenance-window + version-stepping-stone gates, and auto-rollback. ARM64 Raspberry Pi support remains paused pending physical hardware. See [docs/release-notes-0.3.0.md](docs/release-notes-0.3.0.md) for the full v0.3.0 changelog.
 
 ## What is this?
 
@@ -24,23 +24,34 @@ KubeSolo OS combines **Tiny Core Linux** (~11 MB) with **KubeSolo** (single-bina
 
 ## Quick Start
 
+### x86_64 ISO
+
 ```bash
-# Fetch Tiny Core ISO + KubeSolo binary
-make fetch
-
-# Build custom kernel (first time only, ~25 min, cached)
-make kernel
-
-# Build Go binaries
+make fetch          # Tiny Core ISO + KubeSolo binary
+make kernel         # Custom kernel (first time only, ~25 min, cached)
 make build-cloudinit build-update-agent
-
-# Build bootable ISO
 make rootfs initramfs iso
-
-# Test in QEMU
 make dev-vm
 ```
 
+### Generic ARM64 disk image (v0.3.0+)
+
+For Graviton / Ampere / generic UEFI ARM64 hosts:
+
+```bash
+make kernel-arm64       # Mainline 6.12 LTS kernel (first time only, ~30-60 min)
+make rootfs-arm64       # Mainline kernel modules + KubeSolo arm64
+make disk-image-arm64   # UEFI-bootable A/B GPT image
+make test-boot-arm64-disk  # boot smoke test under qemu-system-aarch64
+```
+
+### Raspberry Pi (work in progress)
+
+Build path lives at `make kernel-rpi` / `make rpi-image`; needs physical
+hardware to validate the firmware + autoboot.txt path. See
+[docs/arm64-architecture.md](docs/arm64-architecture.md) for the two-track
+build layout.
+
 Or build everything at once inside Docker:
 
 ```bash
@@ -234,9 +245,12 @@ Metrics include: `kubesolo_os_info`, `boot_success`, `boot_counter`, `uptime_sec
 | 5 | CI/CD, OCI distribution, Prometheus metrics, ARM64 cross-compile | Complete |
 | 6 | Security hardening, AppArmor | Complete |
 | - | Custom kernel build for container runtime fixes | Complete (x86_64) |
-| 7 | ARM64 generic (mainline kernel, UEFI, virtio) | In progress (v0.3.0) |
-| 8 | Update engine v2 (state machine, OCI distribution, channels) | In progress (v0.3.0) |
+| 7 | ARM64 generic (mainline kernel, UEFI, virtio) | Complete (v0.3.0, QEMU validated) |
+| 8 | Update engine v2 (state machine, channels, OCI, pre-flight gates) | Complete (v0.3.0) |
 | - | ARM64 Raspberry Pi (custom kernel, firmware, SD card image) | Paused — needs hardware |
+| - | OCI cosign signature verification | Planned for v0.3.1 |
+| - | LABEL=KSOLODATA on ARM64 (replace blkid/findfs path) | Planned for v0.3.1 |
+| - | Real-hardware ARM64 validation (Graviton / Ampere) | Planned for v0.3.1 |
 
 ## License