v3.0.2

# Release 3.0.2

## Highlights

- blasthttp bumped to 0.10.0 (#3385). `Response.decode_error` is surfaced on `HTTP_RESPONSE` events and tagged `decode-error`, so an undecoded body is never treated as content. `redirect_cookies` now passes through `WebHelper.request()`.
- New `js-audit` preset (`bbot/presets/web/js-audit.yml`). trufflehog streams HTTP bodies via stdin and includes the source URL on findings; its `_module_threads` is bumped to 2.
- Test suite parallelized with pytest-xdist (#3353).
- Fix: custom YARA rules matching but emitting nothing (#3374).
- Fix: `docker_pull` crash on a failed registry request.
- Reinstall module deps when they're missing from the environment (#3338). Adds `packaging` as a runtime dependency.
- Raise process pool `max_tasks_per_child` from 25 to 250 (#3375).
- CI: pass benchmark refs through env and quote them (#3354).
- nuclei 3.11.0 to 3.11.1 (#3367); trufflehog 3.95.9 to 3.97.0 (#3376).

## Maintenance

- Dependabot bumps across the uv and github-actions groups: xxhash 4.0.0, ruff 0.16.2, pre-commit 4.6.2, fastapi 0.141.1, uvicorn 0.52.1, lxml 6.1.1, pip 26.2.1, packaging 26.3, tldextract 5.3.2, websockets 16.1.1, mmh3 5.2.1, orjson 3.11.9, regex 2026.7.19, cachetools 7.1.7, pytest-env 1.7.0, pytest-httpserver 1.1.5, actions/setup-python 7.