Release 3.0.2

Highlights

blasthttp bumped to 0.10.0 (#3385). Response.decode_error is surfaced on HTTP_RESPONSE events and tagged decode-error, so an undecoded body is never treated as content. redirect_cookies now passes through WebHelper.request().
New js-audit preset (bbot/presets/web/js-audit.yml). trufflehog streams HTTP bodies via stdin and includes the source URL on findings; its _module_threads is bumped to 2.
Test suite parallelized with pytest-xdist (#3353).
Fix: custom YARA rules matching but emitting nothing (#3374).
Fix: docker_pull crash on a failed registry request.
Reinstall module deps when they're missing from the environment (#3338). Adds packaging as a runtime dependency.
Raise process pool max_tasks_per_child from 25 to 250 (#3375).
CI: pass benchmark refs through env and quote them (#3354).
nuclei 3.11.0 to 3.11.1 (#3367); trufflehog 3.95.9 to 3.97.0 (#3376).

Dependabot bumps across the uv and github-actions groups: xxhash 4.0.0, ruff 0.16.2, pre-commit 4.6.2, fastapi 0.141.1, uvicorn 0.52.1, lxml 6.1.1, pip 26.2.1, packaging 26.3, tldextract 5.3.2, websockets 16.1.1, mmh3 5.2.1, orjson 3.11.9, regex 2026.7.19, cachetools 7.1.7, pytest-env 1.7.0, pytest-httpserver 1.1.5, actions/setup-python 7.