chore(catalog): publish signed API 0.3 GitOps releases

[deveshk0]

Update Flux to 0.4.0 and Argo CD to 0.3.0, the signed declarative-action releases for extension API ^0.3. Both entries pin the tested host commit 67ef94ad06271813817697e9ee81114cd3bd7876 from srelens/srelens#674. The manifests now request explicit write grants; reading a resource does not grant mutation access.

Published releases:

• Flux 0.4.0, from merged feat: declare guarded Flux actions for API 0.3 extension-flux#4.
• Argo CD 0.3.0, from merged feat: declare guarded Argo CD actions for API 0.3 extension-argocd#4.

Validation:

• Downloaded actual release manifest, detached signature and SHA256SUMS assets. Both Ed25519 signatures verified with the host-pinned publisher key; checksums match the catalog entries and manifests exactly match the tested host examples.
• Each extension passed its real host validator and signing release workflow.
• python3 scripts/catalog.py --check correctly reported stale output after editing entries; regenerated catalog passes the check and all 5 catalog tests.
• GitNexus refreshed and staged changes checked; low impact.

Merge before the API 0.3 host PR, then rerun its live catalog/signature check. Existing API 0.1 hosts will reject these new versions as incompatible. No published assets were replaced.

Part of srelens/srelens#551.