release: v0.10.3, because npm and the Marketplace still showed the old project

[sjh9714]

Why a version number for a docs change

#191 fixed the copy. Neither surface reads from the default branch:

• npm packages are immutable. The README shown on npmjs.com comes from the
  published tarball.
• The Marketplace listing takes its description from action.yml at the
  released tag, and v0.10.2 was tagged before the fix.

So the fixes are currently inert. Right now, on the version published an hour
ago, npmjs.com/package/mergewarden opens with:

MergeWarden is a checkout-free policy gate for AI-generated GitHub pull requests

and tells people to run:

npx mergewarden@0.8.0 scan owner/repository#123

Two releases behind, no mention of triage, and the claim that authentication
is optional for public repositories, which is false for triage.

No behaviour changed. This release exists so those pages stop lying.

Verification

pnpm audit with no severity filter was run before the tag, which is the
order v0.10.0 taught.

Because the point of this release is the packaged README, that file was read
back out of the tarball rather than trusted from the working tree:

$ tar -xzOf mergewarden-0.10.3.tgz package/README.md | head -2
# MergeWarden CLI
Reads a GitHub pull request through the API and reports what a maintainer would
$ ... | grep -oE "mergewarden@[0-9.]+" | sort -u
mergewarden@0.10.3
$ ... | grep -c triage
2

Cold install into an empty directory reports 0.10.3.

pnpm install --frozen-lockfile, build, test (461), typecheck, lint,
format:check: all green.

After merge

SHA pins move to the v0.10.3 commit in a follow-up, as with the last two
releases. docs/demo-prs.md keeps its older SHAs.