[austin-barrington]

Release v0.3.3 (chart 0.3.3, set in #19).

• Restart each pod once per rolling update (v0.3.3) #19: each pod restarts once per rolling update. With the proxy enabled, the StatefulSet partition is pinned and the operator releases one pod at a time, after the exclude and drain.
• Back up with the AWS CLI; build on Go 1.27.3 (CVE-2026-111943) #20:
  • Backup and restore jobs use amazon/aws-cli:2.38.5; minio/mc can no longer be pulled from Docker Hub.
  • The operator is built with Go 1.27.3 on a current distroless base, which no longer trusts the compromised eMudhra root (CVE-2026-111943).
• This PR:
  • The operator now knows HyperbyteDB 0.9.3-beta as its newest version, so a 0.9.3-beta cluster no longer reads NewerThanKnown. Nothing renders differently.
  • docs/compatibility.md gets the v0.3.3 row and Back up with the AWS CLI; build on Go 1.27.3 (CVE-2026-111943) #20's upgrade notes.

Checked on kind with HyperbyteDB 0.9.3 images built from main:

• Setup: a 3-node sync_quorum + hinted handoff pool and a 1-node pool, both behind the proxy, at 10 writes/s and 5 queries/s, with a pod template change mid-stream. Three runs.
• Restarts: one restart per pod in every run.
• Writes: every acknowledged write on every pod.
• Errors: none in the 3-node pool. The 1-node pool had 16 × 503 (about 1.6 s) in the first run only.

Unit, envtest and lint pass under golang:1.27.3.