chore(main): release 0.3.0

[github-actions]

🤖 I have created a release beep boop

0.3.0 (2026-07-25)

⚠ BREAKING CHANGES

• frontend: the SSO callback redirect no longer carries a token in its fragment. Anything that scraped it must read GET /auth/me instead.
• operator: default workload placement to a per-user namespace
• api-server: stop accepting access_token query auth outside the SSE stream
• drop the v prefix from appVersion and promoted image tags

Features

• api-server: accept the access token from a session cookie (7d05385)
• api-server: discover the cluster DNS domain from resolv.conf (82d60bd)
• api-server: end the session when an edit revokes its own author (0a9e398)
• api-server: fetch the catalog when an admin creates or repoints an image (726c0ec)
• api-server: hand browsers a session cookie at login and SSO callback (616cb5b)
• api-server: make the per-user namespace actually per-user (4014cf7)
• api-server: mint short-lived stream tokens via POST /auth/stream-token (5572876)
• api-server: persist a per-user token-validity bound (898b99e)
• api-server: reject in-cluster targets for remote workspaces (89979f3)
• api-server: revoke sessions on logout, deactivation, role and password change (25ffb30)
• api-server: sync manifest-created catalog sources from the shared image watch (b7ac606)
• frontend: authenticate with the session cookie, store no credential (6a55424)
• frontend: revoke the session server-side on logout (da30963)
• helm: parameterize the bundled postgres sslmode (4394709)
• helm: parameterize the bundled postgres sslmode (4b0245c)
• operator: default workload placement to a per-user namespace (aa76c9a)
• shared: add waas-stream token audience for the SSE stream (fff570c)

Bug Fixes

• api-server: bound the admin catalog force-sync with a deadline (8bd2907)
• api-server: cap the Postgres connection pool (4b75a8a)
• api-server: cap the Postgres connection pool (9c56ccc)
• api-server: enforce immediate session revocation (fa34294)
• api-server: enforce the admin floor in the write, not in a pre-check (007e91f)
• api-server: evaluate the catalog resync discriminant under the sync lock (c59a14e)
• api-server: expire the session cookie when the caller changes their password (aedbf78)
• api-server: keep a hanging catalog source a 502, not a busy 503 (60b9b57)
• api-server: keep role and active out of full-row user writes (acf15e4)
• api-server: keep role and active out of full-row user writes (949f476)
• api-server: keep the token bound out of full-row user writes (c8d9268)
• api-server: re-check user state on every authenticated request (4fe23bb)
• api-server: reject in-cluster targets for remote workspaces (3a85015)
• api-server: reject valueFrom in override env input (d878cdf)
• api-server: restore modernc.org/libc to v1.74.1 (e01ac1f)
• api-server: retry lifecycle updates on conflict, surface 409 (f42ad4f)
• api-server: retry lifecycle updates on conflict, surface 409 (436b9e3)
• api-server: stop accepting access_token query auth outside the SSE stream (d878b1e)
• api-server: sync the catalog when an image first becomes eligible (1439797)
• dev: pin dev-ssh to the shared namespace its seeded Secret lives in (097e9ce)
• frontend: cite the per-user default in the placement hint (1b6d914)
• frontend: clear local auth state instead of revoking on error paths (5e4b9fc)
• frontend: open the SSE stream with a minted stream token, not the API bearer (d8a4d40)
• frontend: sign out explicitly after a password change (7b6980b)
• frontend: sign out from the server's session-ended announcement (ce014d6)
• make the per-user namespace actually per-user (f8870fe)
• operator: default-deny egress on placed namespaces (70b8304)
• operator: refuse a deviation into another user's personal namespace (d362ba6)
• operator: reject valueFrom in workspace override env (746dbb5)
• operator: reject valueFrom in workspace override env (976da9a)
• operator: resolve the personal namespace instead of rebuilding it (00c1797)
• operator: stop auto-mounting the SA token in desktop pods (4f664d8)
• operator: stop auto-mounting the SA token in desktop pods and netpol block on critical intern cluster stuff (976e6d0)
• wwt: bound guacamole element length to stop remote crash of the of the shared tunnel (067536c)
• wwt: bound guacamole element length to stop remote crash of the shared tunnel (f60d9f9)

Continuous Integration

• drop the v prefix from appVersion and promoted image tags (d33c6f9)

---

This PR was generated with Release Please. See documentation.