chore: prepare release v0.3.0

[CSSFrancis]

Release v0.3.0

The Prepare Release workflow built this branch. It could not open the PR
itself — "Allow GitHub Actions to create and approve pull requests" was off at
the time (run 35946767500)
— so this body is the one it would have written. The branch's contents are
exactly what the workflow produced.

What changed

• de_shell/__init__.py bumped to 0.3.0 — the one place the version is
  written, and the value publish.yml refuses to let a tag disagree with
• Pre-flight check passed: git dependencies pinned to SHAs or tags
• CHANGELOG.rst assembled from the fragments in upcoming_changes/; three
  consumed (2.bugfix, 7.maintenance, +towncrier.maintenance)

Release notes (as they appear in CHANGELOG.rst)

0.3.0 (2026-09-24)
==================

Bug Fixes
---------

- An end-to-end launch through the testing harness left its temporary Electron
  profile directory behind — a few megabytes per launch, and a downstream app's
  full suite added about 150. ``closeApp`` now removes it once the process is
  down, on the clean-close, hard-kill and no-app paths alike, and ``launchApp``
  reports the path as ``profileDir``. (`#2 <https://github.com/directelectron/de-shell/pull/2>`_)


Maintenance
-----------

- A **Prepare Release** workflow bumps the version, assembles the changelog and
  opens the release pull request, so the tag and ``de_shell.__version__`` agree by
  construction rather than being checked against each other after the tag is
  pushed. (`#7 <https://github.com/directelectron/de-shell/pull/7>`_)
- The changelog is now assembled by `towncrier
  <https://towncrier.readthedocs.io/>`_ from one news fragment per pull request
  under ``upcoming_changes/``, as SpyDE and anyplotlib already do, and lives in
  ``CHANGELOG.rst`` rather than ``CHANGELOG.md``.

Before merging

• fix(env): run the packaged sidecar from the env, not the install directory #4 is not in this release. The packaged-sidecar fix — the root cause of
  the Windows auto-update dead end reported against SpyDE — is still open. A minor
  bump carrying only a test-harness fix does nothing for a SpyDE user, so this is
  worth re-cutting after fix(env): run the packaged sidecar from the env, not the install directory #4 lands, unless 0.3.0 is deliberately a maintenance release.
• CHANGELOG.rst reads well — edit the assembled text directly if needed
• Version is correct in de_shell/__init__.py
• CI passes. The wheel-contents leg matters most: it fails if de_shell/js is
  missing, which is the whole point of the package.

Manual check CI cannot cover

CI never runs Electron — it typechecks the TypeScript and runs the node unit
tests, nothing more. Before tagging a release that touched the sidecar protocol
or de_shell/js:

• Link this tree into one app (python -m de_shell.js prints the path) and
  run that app's e2e suite against it.

After merging

Tag the merge commit on main — the tag MUST be exactly v0.3.0:

git fetch origin
git tag v0.3.0 origin/main
git push origin v0.3.0

The tag push triggers publish.yml: it refuses a tag that does not match
de_shell.__version__, builds the distributions, checks the wheel carries
de_shell/js, and uploads to PyPI through trusted publishing.

• Confirm it actually published before telling the apps to pin it:
  uv pip index versions de-shell should list 0.3.0.