0.3.0: the download URL was still serving convergence that let packages rot

`releases/latest/download/` resolves to the newest non-prerelease, which
is still v0.2.0, and that binary bakes the scoped syncs. So the front
door has been handing out the behaviour `7d6ca7e` fixed, and of the
things to ship late this is the worst one, because a machine built from
it looks healthy while nothing it installs outside the declaration ever
updates. The rolling `latest` prerelease already carried the fix;
only the tagged path lagged.

Cargo.lock moves with Cargo.toml. It records the workspace member's own
version, so bumping one without the other fails every `--locked` call,
which is most of CI.

Author: Letdown2491

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "kuma"
-version = "0.2.0"
+version = "0.3.0"
 edition = "2021"
 # Set by sha-crypt 0.6, the highest floor anything here asks for. Without
 # it, an older toolchain fails somewhere inside a dependency instead of