feat(sidecar)!: bump PROTOCOL_VERSION to 3

Protocol 3.0 is feature-complete on `edge` -- world.ruleset, points.board and
vendor.listing / vendor.listing.remove all landed there while the sidecar kept
declaring 2, because a bump is an operator-visible hard break (409 on every
protected route via web.rs::gate, and the website closes the WS on the ws.hello
mismatch). Doing it per phase would have broken the site four times; this is the
one time it happens.

Nothing that existed in v2 changed shape, so the version constant and its doc
comment are the whole change here. The README's worked example moves with it --
it still claimed "currently 1", two bumps stale.

Verified against the release binary: /health reports "protocol": 3, every
response carries `X-UOLink-Version: 3`, an authenticated request declaring 2 is
refused 409 {"sidecar_protocol":3,"client_protocol":"2"}, and one declaring 3
gets 200 off /ruleset. cargo build --release + cargo clippy --all-targets clean.

Co-Authored-By: Claude <noreply@anthropic.com>

sidecar/src/main.rs

@@ -24,7 +24,12 @@ use tracing_subscriber::EnvFilter;
 /// v2 (Protocol 2.0): adds the account-provisioning verbs/endpoints (`POST /accounts/create`,
 /// `DELETE /link/:account`) and their events. Outbound event kinds are additive, so a v1 website
 /// keeps working against the live feed; the new *endpoints* require a v2 sidecar.
-pub const PROTOCOL_VERSION: u32 = 2;
+///
+/// v3 (Protocol 3.0): adds `world.ruleset`, `points.board` and `vendor.listing` /
+/// `vendor.listing.remove`, with the `GET /ruleset`, `/points` and `/market` reads that serve them
+/// from the store. Same shape as the v2 bump — the kinds are additive, the endpoints are not — and
+/// there is deliberately no feature-negotiation array: v3 implies all three kinds.
+pub const PROTOCOL_VERSION: u32 = 3;
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {