chore(release): v0.3.0 (#4)

## Release v0.3.0

Minor release. Adds the reusable release workflow caller and bumps
`.claude-plugin/plugin.json` and `skills/peer-qa-review/SKILL.md`
frontmatter `metadata.version` from `0.2.0` to `0.3.0`.

### Highlights since v0.2.0

- **npm distribution** — the skill now ships as an npm package via
`@netresearch/agent-skill-coordinator`, joining Composer and the Claude
Code marketplace as a first-class install path (#3).

### Release pipeline

This is the first release of `peer-qa-review-skill` cut against the
standardized `skill-repo-skill` reusable release workflow. The new
`.github/workflows/release.yml` caller wires up:

- signed-tag-only release trigger,
- cosign-keyless `SHA256SUMS.txt` signing,
- SLSA build-provenance attestations on every archive,
- GitHub native attestation API verification via `gh attestation
verify`.

### Release plan

After merge: tag main with a signed annotated tag, push, the reusable
workflow at
`netresearch/skill-repo-skill/.github/workflows/release.yml@main`
publishes archives + SHA256SUMS with cosign + SLSA attestation, then
narrative notes get applied via `gh release edit --notes-file`.

Author: CybotTM

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "peer-qa-review",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Round-1 IT QA runbook: peer review of completed work before customer acceptance or internal close. Lifecycle, checklist, severity vocabulary, comment template, edge cases, anti-patterns. Generic for any IT/Ops team.",
   "repository": "https://github.com/netresearch/peer-qa-review-skill",
   "license": "(MIT AND CC-BY-SA-4.0)",

.github/workflows/release.yml

@@ -0,0 +1,14 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  release:
+    uses: netresearch/skill-repo-skill/.github/workflows/release.yml@main
+    permissions:
+      contents: write          # release upload
+      id-token: write          # OIDC for sigstore (required by the attest job)
+      attestations: write      # GitHub native attestation API (required by the attest job)

skills/peer-qa-review/SKILL.md

@@ -5,7 +5,7 @@ license: "(MIT AND CC-BY-SA-4.0). See LICENSE-MIT and LICENSE-CC-BY-SA-4.0"
 compatibility: "Requires a ticket system (Jira tested; works conceptually with Linear/GitHub Issues/etc.) and shell access for verification. Companion: jira-communication skill for ticket I/O."
 metadata:
   author: Netresearch DTT GmbH
-  version: "0.2.0"
+  version: "0.3.0"
   repository: https://github.com/netresearch/peer-qa-review-skill
 allowed-tools: Bash Read Write Edit
 ---