spec prose: status bookkeeping catches up with the 0.3.0 query-fold

[koishore]

Why

A conformance review (2026-06-11) replayed the full CTK against the local reference (delego 0.3.4, protocol 0.3) — every vector reproduces — but found spec.md contradicting itself. When the reference shipped the §4.2 query-fold (delego 0.3.0; CTK regenerated in #9), the spec body was deliberately left untouched, so its status prose still describes the pre-fold world:

• §2.1's version table and tag legend, the §10 preamble, and the §10 "0.3 — deferred (breaking)" block called the query-fold deferred / not part of 0.3 and said "the reference implements 0.2" — while §4.2 (normative), the CTK README, and conformance.py all treat the fold as 0.3 and reference-backed (hashing.json is wired and passing on the 0.3 preimage).
• The §4.1 worked example ("authoritative") still showed the 0.2 preimage (no query key) and 0.2 fingerprints, contradicting the §4.2 preimage and ctk/vectors/hashing.json.

What

Status/prose only — no normative design text changed (same precedent as #11's §9 status flip):

• §2.1 — 0.3 row: reference-complete, CTK-backed; the query-fold is the 0.3 breaking change (reference-backed since 0.3.0; 0.2 preimage preserved as hashing-v0.2.json). "The reference implements 0.3." Inline (0.3, draft — additive) tags → (0.3 — additive).
• §4.1 — worked example regenerated on the 0.3 preimage; all three fingerprints now match hashing.json.
• §4.2 + §10 — the Broker query obligation is scoped to the ≤ 0.2 preimage, with a note that the fold supersedes it on 0.3 (matching the CTK README's broker_query.json supersession); the §10 deferred block becomes the 0.3 — breaking conformance line; the §10 token parenthetical now quotes §9's actual TTL rule (SHOULD ≤ 60 s, MUST NOT exceed 300 s) instead of "≤ 60 s exp".
• examples/authorization-token.{md,json} — dropped the stale "not yet minted by the reference" note (reference-backed since 0.3.3, CTK: §9 authorization-token vectors; mark §9 reference-backed (0.3.3) #11); fpr updated to the place-order's 0.3 fingerprint so the example matches hashing.json as its prose claims.
• README — Status & versioning rewritten to the same state; repaired spec.md anchor links (§7.1 retag in this PR; the two §9 links had been broken since CTK: §9 authorization-token vectors; mark §9 reference-backed (0.3.3) #11's heading change).
• CHANGELOG — Unreleased entry.

Verification

• validate.py and conformance.py green against delego 0.3.4 (all hashing/decisions/resolve/chain/token vectors reproduce; reference 0.3 <= spec 0.3).
• All spec.md# anchors across the repo resolve against the updated headings (checked with a slug script).