docs(milestone): complete scheduling-streaming (v0.3)

---ci---
project: orca
phase: 3
milestone: v0.3
status: complete
requirements:
  covered: [REQ-022, REQ-030, REQ-032]
  partial: []
---/ci---

v0.3 milestone merged to main. Includes all v0.2 work (P08-P10) that
was previously on the milestone branch but not yet merged to main, plus
the v0.3 completion work (iter.Seq streaming + doctor network/db).

v0.2 phases included: P08 (mTLS), P09 (scheduling), P10 (security scan).
v0.3 phases: P0 (pre-execution), P1 (iter.Seq streaming), P2 (doctor),
P3 (final review+ship).

Total: 40 requirements, all complete. No new go.mod dependencies.
Full test suite passes under -race. gofmt + go vet clean.

.coreci.yml

@@ -8,10 +8,17 @@ description: Orca — offline/CLI-first orchestration engine. Full release flow
 # All four pipelines (validate, build, test, release) must pass before a tag
 # can be published. The release pipeline is gated on the existence of a
 # semver tag (vX.Y.Z) and is the only pipeline that touches the Gitea API.
+#
+# P03 (v0.2) added three security-scanning stages to the `validate` pipeline:
+#   - gosec        (REQ-014, REQ-040)  Static analysis for Go security smells
+#   - govulncheck  (REQ-014, REQ-027)  Offline vuln scan of dependencies
+#   - gitleaks     (REQ-039)          Pre-commit-style secret scan
+# The `test` pipeline runs with -race (REQ-031).
+# See docs/security-scanning.md for operator-facing details.
 
 pipelines:
   validate:
-    description: Validate Go toolchain and code formatting
+    description: Validate Go toolchain, formatting, and security scans
     steps:
       - name: go-version
         image: golang:1.25
@@ -20,6 +27,29 @@ pipelines:
           - gofmt -l .
           - go vet ./...
 
+      - name: gosec
+        image: golang:1.25
+        commands:
+          - go install github.com/securego/gosec/v2/cmd/gosec@v2.18.2
+          - gosec -fmt text -quiet ./...
+
+      - name: govulncheck
+        image: golang:1.25
+        env:
+          # REQ-027: offline mode. GOFLAGS=-mod=mod ensures module mode;
+          # GOVULNCHECK_DB (when present) overrides the bundled DB.
+          GOFLAGS: -mod=mod
+        commands:
+          - go install golang.org/x/vuln/cmd/govulncheck@v1.1.3
+          - govulncheck -mode binary ./...
+
+      - name: gitleaks
+        image: golang:1.25
+        commands:
+          - apk add --no-cache curl
+          - sh -c "$(curl -fsSL https://github.com/gitleaks/gitleaks/releases/latest/download/install.sh)"
+          - gitleaks detect --source . --config .gitleaks.toml --baseline-path .gitleaks-baseline.json --no-banner
+
   build:
     description: Build the orca binary with version injection
     steps:
@@ -40,7 +70,7 @@ pipelines:
           - ./bin/orca version
 
   test:
-    description: Run all tests with race detection and coverage
+    description: Run all tests with race detection and coverage (REQ-031)
     steps:
       - name: test
         image: golang:1.25
@@ -78,6 +108,7 @@ pipelines:
           - apk add --no-cache curl tar
           - sh -c "$(curl -fsSL https://gitea.com/gitea/tea/releases/latest/download/install.sh)"
           - tea releases create ${VERSION}
+              --repo coreci/orca
               --title "Orca ${VERSION}"
               --note-file CHANGELOG.md
               --asset orca-${VERSION}-linux-amd64.tar.gz