chore(main): release chart 0.3.0

[github-actions]

🤖 I have created a release beep boop

0.3.0 (2026-07-25)

⚠ BREAKING CHANGES

• helm: with workspaces.defaultNamespacePattern unset, new workspaces now land in "waas-{user}" instead of the shared "waas-workspaces". Existing workspaces keep their frozen spec.targetNamespace; set defaultNamespacePattern to "waas-workspaces" to keep the previous shared behavior.
• helm: users covered only by the bootstrap default policy can no longer set spec.overrides.volumes at creation. Deployments that relied on it must grant the right explicitly via defaultPolicy.overrides.allowedFields or a higher-priority WorkspacePolicy, and should read the implications in docs/accepted-limitations.md first.
• drop the v prefix from appVersion and promoted image tags

ci

• drop the v prefix from appVersion and promoted image tags (d33c6f9)

Features

• helm: default workload placement to a per-user namespace (60532d2)
• helm: expose apiServer.clusterDomain and remoteBlockedCIDRs (637a45d)
• helm: expose apiServer.streamTokenTTL (9688144)
• helm: expose operator.desktopEgress values (463dea4)
• helm: parameterize the bundled postgres sslmode (4394709)
• helm: parameterize the bundled postgres sslmode (4b0245c)

Bug Fixes

• api-server: reject in-cluster targets for remote workspaces (3a85015)
• helm: stop granting the volumes override in the default policy (fc614eb)
• operator: stop auto-mounting the SA token in desktop pods and netpol block on critical intern cluster stuff (976e6d0)

Chores

• deps: update bitnami/kubectl:latest docker digest to 95de17e (8903648)
• deps: update bitnami/kubectl:latest docker digest to 95de17e (f558af9)

---

This PR was generated with Release Please. See documentation.