docs(milestone): complete scheduling-streaming (v0.3)

---ci---
project: orca
phase: 3
milestone: v0.3
status: complete
requirements:
  covered: [REQ-022, REQ-030, REQ-032]
  partial: []
---/ci---

v0.3 milestone merged to main. Includes all v0.2 work (P08-P10) that
was previously on the milestone branch but not yet merged to main, plus
the v0.3 completion work (iter.Seq streaming + doctor network/db).

v0.2 phases included: P08 (mTLS), P09 (scheduling), P10 (security scan).
v0.3 phases: P0 (pre-execution), P1 (iter.Seq streaming), P2 (doctor),
P3 (final review+ship).

Total: 40 requirements, all complete. No new go.mod dependencies.
Full test suite passes under -race. gofmt + go vet clean.

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build test lint fmt clean run release version changelog help
+.PHONY: build test test-race lint fmt clean run release version changelog help security-scan
 
 BINARY := bin/orca
 GOFLAGS := -trimpath
@@ -19,15 +19,17 @@ LDFLAGS := -s -w \
 
 help:
 	@echo "orca — make targets"
-	@echo "  build       Build binary to $(BINARY) (injects version via -ldflags)"
-	@echo "  test        Run tests with race detection"
-	@echo "  lint        Run gofmt + go vet"
-	@echo "  fmt         Format code"
-	@echo "  clean       Remove build artifacts"
-	@echo "  run         Build and run with args (use: make run ARGS='version')"
-	@echo "  version     Print the version string that would be injected"
-	@echo "  changelog   Generate CHANGELOG.md from ---ci--- commit blocks"
-	@echo "  release     Run scripts/release.sh [VERSION] — build, tar, publish"
+	@echo "  build           Build binary to $(BINARY) (injects version via -ldflags)"
+	@echo "  test            Run tests"
+	@echo "  test-race       Run tests with race detection (REQ-031)"
+	@echo "  lint            Run gofmt + go vet"
+	@echo "  fmt             Format code"
+	@echo "  clean           Remove build artifacts"
+	@echo "  run             Build and run with args (use: make run ARGS='version')"
+	@echo "  version         Print the version string that would be injected"
+	@echo "  changelog       Generate CHANGELOG.md from ---ci--- commit blocks"
+	@echo "  release         Run scripts/release.sh [VERSION] — build, tar, publish"
+	@echo "  security-scan   Run gosec+govulncheck+gitleaks (P03, REQ-014/027/039)"
 
 build:
 	@mkdir -p bin
@@ -35,6 +37,11 @@ build:
 	go build $(GOFLAGS) -ldflags="$(LDFLAGS)" -o $(BINARY) $(PKG)
 
 test:
+	go test -coverprofile=coverage.out ./...
+
+# test-race runs the full test suite under the race detector (REQ-031).
+# Wired into the .coreci.yml `test` pipeline as well.
+test-race:
 	go test -race -coverprofile=coverage.out ./...
 
 lint:
@@ -83,3 +90,11 @@ release:
 	  exit 1; \
 	fi
 	./scripts/release.sh $(VERSION)
+
+# security-scan runs the three tools integrated in P03 (REQ-014,
+# REQ-027, REQ-039). Local equivalent of the .coreci.yml `validate`
+# security stages. Exits non-zero on any unsuppressed finding.
+# The script handles tool detection (silently skips tools not on PATH
+# in a developer's local environment; CI requires all three).
+security-scan:
+	./scripts/security_scan.sh