v0.3.0 — entitlements catalog in PublicPoliciesResponse

Mirrors the Keysat migration 0014 server-side change. The product
object on listPublicPolicies() now includes entitlementsCatalog —
the closed list of {slug, name, description} the operator declared
on the product. SDK consumers' in-app tier pickers can render the
human-readable name ("AI summaries") with the description as a
tooltip instead of the raw slug ("ai_summaries").

New exports:
- EntitlementDef type
- PublicPoliciesResponse.product.entitlementsCatalog: EntitlementDef[]

Empty array on legacy products that don't have a catalog yet —
SDK consumers fall back to rendering the raw policy.entitlements
slugs directly. No breaking change to existing consumers.

Bumps to 0.3.0 minor since the surface is purely additive.
15/15 crosscheck tests still pass.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keysat/licensing-client",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Client library for Keysat. Verifies signed license keys offline and wraps the HTTP API for purchase and revocation checks.",
   "type": "module",
   "main": "./dist/index.cjs",