3.0.0 - baked-recipe component model BREAKING: every component's logic now lives in pipeline.just, baked into the ci-* images at /opt/dunn-pipeline/justfile. Templates are thin `just` wrappers and inputs pass via variables:. The `image:`-override escape hatch (run a component on a vanilla base and install tools on-demand) is removed: overriding `image:` to a base without the baked justfile will fail. Pin a ci-* image (the default) or fork the recipe. Migrated families: go, rust, node, the L0 gate (osv-verdict + automerge-gate), the ops/deploy family (cloudflare-pages/worker/r2, reference-check, slsa-attest, release-create, claude-drift-triage), and container-sbom. container-image stays inline by design (foreign buildah image, no baked justfile). No consumer-facing contract change: every component's inputs, artifacts, and behavior are identical to 2.7.0. Only the internal execution model changed.