chore(release): bump workspace version to 0.3.3

v0.3.2 is a burned version: its tag fired a Release run that died on
the download-artifact/dockerbuild race (fixed in the previous commit),
before any GH Release or npm publish happened. Rather than force-move
the already-pushed tag, cut v0.3.3 from the fixed workflow.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Your Name

Cargo.lock

@@ -17,7 +17,7 @@ members = [
 # version against the downloaded release binary's real `--version` output
 # and treats any mismatch as a corrupted/wrong download, so a stale value
 # here silently defeats the verified-download fast path for everyone.
-version = "0.3.2"
+version = "0.3.3"
 edition = "2024"
 license = "MIT"
 rust-version = "1.85"