chore(main): release 3.0.0

[github-actions]

🤖 I have created a release beep boop

3.0.0 (2026-09-29)

⚠ BREAKING CHANGES

• the CI API is now gate.yml + security.yml. Direct references to java.yml/ts.yml/php.yml/tier0.yml/semgrep.yml must move to the facades. @v1 keeps the old names frozen; adopt the facades at @v2.

Features

• add feature-driver ticket schema, issue template, and design (0d8e640)
• add Java, PHP and HTML/CSS stacks (1feb53b)
• bootstrap: auto-merge prune baseline PRs (8393e39)
• bootstrap: auto-merge prune baseline PRs (6cd0609)
• bootstrap: reusable habit-hooks baseline refresh + split/branch-protection docs (9f2623d)
• ci: actionable failure summaries + cache semgrep install (d26ea5a)
• ci: add reusable java.yml and php.yml gate workflows (a9d4ca2)
• ci: autofix.yml — label-triggered mise run fix in CI (c424b33)
• ci: automated versioning via release-please + commitlint (b2eb6d7)
• ci: automated versioning via release-please + commitlint (99bf775)
• ci: decompose the gate into per-verb steps with targeted fixes (9c7250d)
• ci: ratchet-report PR comment making baseline movement visible (cf67a2f)
• dotnet: first-class .NET/C# stack (9a9f41d)
• dotnet: first-class .NET/C# stack via the gate facade (05393fe)
• facade API — gate.yml/security.yml front the per-stack internals (bc3577f)
• feature-driver ticket schema, issue template, and design (b9a28d1)
• habit-hooks: jscpd test-exclusion preset + guard it (b00e106)
• habit-hooks: jscpd test-exclusion preset + ruleset-guard it (c7bdbe0)
• habit-hooks: port pilot lessons into presets (d163e47)
• initial Foundry gate — verb interface, reusable workflows, design (7b7460b)
• java: route facade SpotBugs through a mise verb (da9e39c)
• java: route the facade SpotBugs job through a mise run spotbugs verb (ea11c4a)
• labels: reusable setup-labels.sh + wire into foundry-init; drop local-md (3b2f9b0)
• mise/java: pin + auto-provision PMD (6dccf14)
• mise/java: pin + auto-provision PMD (setup:pmd task + postinstall hook) (aceec97)
• per-smell Java guides preset + foundry-init sets shell-args globally (0b6227f)
• preset: agent-loop.md — the canonical self-correcting agent loop (d321861)
• preset: agent-loop.md — the canonical self-correcting loop (29d0f7b)
• renovate: dependency-update automation to close the pin-everything loop (2a04ab4)
• scaffold: foundry-init — one-shot onboarding for a repo (c01d778)
• scaffold: schedule the generated bootstrap caller (weekly auto-prune) (a062b59)
• setup-labels.sh + GitHub-only tickets (drop local-md) (6e19907)
• ship per-smell Java guides + set shell-args globally in foundry-init (c3edfe0)
• stacks: add kotlin, dotnet and python verb templates + presets (f80d97d)
• standards: add code-standards.md — functions do one thing (SRP) (4e5c0f2)
• standards: cohesion + magic values + size limits (file-length 300, line-length eslint, foundry-allow-smell) (547d487)
• standards: foundry-allow-smell PMD marker + base eslint config (line-length) (8faa2a6)
• tier0: make ruleset-guard tightening-aware (fbf4c02)
• tooling: changed-scope, loop telemetry, arch fitness, flake triager, prompt-eval (6df77cc)
• tooling: changed-scope, telemetry, arch fitness, flake triager, prompt-eval (14853b4)
• ts: ratcheted npm audit for the audit verb (760c0e0)
• ts: ratcheted npm audit for the audit verb (b5086d6)
• ts: typecheck requires a tsconfig and type-checks Deno code (e28f777)
• ts: typecheck requires a tsconfig and type-checks Deno code (c1a840c)

Bug Fixes

• ci: pass github context via env in run: steps (shell-injection) (d677a73)
• ci: security facade startup failure and ratchet-report on a new baseline (ce67565)
• ci: security facade startup failure and ratchet-report on a new baseline (5e16845)
• docs: 'criticals' -> 'critical' in CHANGELOG (typos check) (cc07276)
• docs: 'criticals' -> 'critical' in the gate demo (d4bbe15)
• habit-hooks: [sensors.pmd] args must be a TOML array (string is mangled) (d3b6f1c)
• habit-hooks: name the tuned PMD ruleset via -R, not silent discovery (e6db03d)
• habit-hooks: positive include in every preset (bare exclusion scanned nothing) + bootstrap --no-snooze (8871126)
• java preset: disable jscpd (Node CLI) — keep generic's file-length only (c9198b2)
• tier0: guard diffs from merge-base so a stale base.sha can't false-flag (55d2c1c)
• tier0: per-entry loosening check via scripts/ruleset_guard.py (49dbf13)
• workflows: snake_case reusable-workflow inputs (1ba6c33)

Performance Improvements

• ts: cache node_modules to skip npm ci rebuilds (1a13564)

---

This PR was generated with Release Please. See documentation.

[CMaintz]

Phantom 3.0.0 — a release-please leftover. release-please is being retired (workflow already off main; #38 finishes it + adds cut-release.sh). No 3.0.0 is warranted (latest is v2.3.0).