release: v0.3.0 — 4 new CVE modules (24 total)

iamroot.c: bump IAMROOT_VERSION 0.2.0 → 0.3.0
  CVES.md: add inventory entries for nft_set_uaf, af_unix_gc,
           nft_fwd_dup, nft_payload; extend operations table;
           bump counts (🟢 13 · 🟡 11 · 🔵 0 · ⚪ 1).
  README.md: update Status to 24 modules, list all 11 🟡 modules.

Module families now spanning:
  - copy_fail_family (page-cache write)
  - nf_tables (4 modules: nf_tables, nft_set_uaf, nft_fwd_dup, nft_payload)
  - af_packet (2 modules: af_packet, af_packet2)
  - overlayfs (2 modules: overlayfs CVE-2021-3493, overlayfs_setuid)
  - af_unix (new in v0.3.0)
  - plus 10 single-CVE families

README.md

@@ -94,20 +94,21 @@ The same binary covers offense and defense:
 
 ## Status
 
-**Active — v0.2.0 cut 2026-05-16.** Corpus covers **20 modules**
+**Active — v0.3.0 cut 2026-05-16.** Corpus covers **24 modules**
 across the 2016 → 2026 LPE timeline:
 
 - 🟢 **13 modules land root** end-to-end on a vulnerable host
   (copy_fail family ×5, dirty_pipe, entrybleed leak, pwnkit,
   overlayfs CVE-2021-3493, dirty_cow, ptrace_traceme,
   cgroup_release_agent, overlayfs_setuid CVE-2023-0386).
-- 🟡 **7 modules fire the kernel primitive** by default and refuse to
-  claim root without empirical confirmation. Pass `--full-chain` to
-  engage the shared `modprobe_path` finisher and attempt root pop —
-  requires kernel offsets via env vars / `/proc/kallsyms` /
+- 🟡 **11 modules fire the kernel primitive** by default and refuse
+  to claim root without empirical confirmation. Pass `--full-chain`
+  to engage the shared `modprobe_path` finisher and attempt root
+  pop — requires kernel offsets via env vars / `/proc/kallsyms` /
   `/boot/System.map`; see [`docs/OFFSETS.md`](docs/OFFSETS.md).
-  Modules: af_packet, af_packet2, cls_route4, fuse_legacy, nf_tables,
-  netfilter_xtcompat, stackrot.
+  Modules: af_packet, af_packet2, af_unix_gc, cls_route4,
+  fuse_legacy, nf_tables, netfilter_xtcompat, nft_fwd_dup,
+  nft_payload, nft_set_uaf, stackrot.
 - Detection rules ship inline (auditd / sigma / yara / falco) and
   are exported via `iamroot --detect-rules --format=…`.