docs: record v0.3 security validation

docs/VALIDATION.md

@@ -1,5 +1,36 @@
 # Validation
 
+## Version 0.3.0 security validation, 2026-09-13
+
+Implementation commit: `9705b01fe4bca201220c22aed7aab10c17abbf1d`, signed by
+Nic Weyand. This release closes the version 0.2 mutable-path, reviewer-trust,
+resource-bound, compatibility and disclosure findings while preserving the
+source/provenance/review architecture. Writer stores migrate to schema version 3
+and `argand.site-rules/v3`.
+
+Linux x86_64 with Rust/Cargo 1.98.1 and Python 3.14.7 passed:
+
+- Formatting, locked all-target compilation, Clippy with warnings denied, strict
+  API documentation, all 38 Rust tests and all eight Python source-release tests.
+- Native CLI, reusable Rust and Python consumer parity across the all-five-source
+  fixture, signed approval, activation, revocation and rollback refusal.
+- Regression checks for post-open SQLite mutation, exact-stream import cleanup,
+  consumer reviewer-trust mismatch, reviewer validity epochs, v1 current-generation
+  activation, metadata-bound identity decisions, Curlie diff redaction and CrUX
+  job identity.
+- `cargo audit --deny warnings` against 1,243 RustSec advisories reported no findings
+  in the 246 locked dependencies.
+
+[Hosted Forgejo Actions run 4](https://git.argand.org/nicweyand/argand-site-registry/actions/runs/4)
+passed the exact implementation commit in the isolated registry runner. It ran the
+offline acceptance, produced two byte-identical source archives and receipts,
+verified the receipt pin, extracted the archive without Git metadata and reran the
+complete acceptance from that source tree. The runner had no dataset, reviewer,
+signing or activation authority.
+
+No provider data was acquired, no review or destination was promoted, and no
+Argand source, build cache, service or public route was changed during this work.
+
 ## Version 0.2.0 release validation, 2026-09-13
 
 Implementation commit: `e83f43d00f38fb1a8973316fc045ac4139069aaa`, signed by