v0.3.0-rc.14

The fourteenth pre-release of 0.3.0, published as a GitHub pre-release and not marked latest. See CHANGELOG.md, [0.3.0-rc.14].

What an operator must do

• Run validate before the next apply. It now refuses an optional link with several providers and no setting, a link sharing a secret with a provider outside the deployment, and an engagement bot_localpart that is not a Matrix localpart; fix whichever it names.
• Run deployment apply on a deployment with an engagement app and a matrix-homeserver. The engagement app then runs the Digest Bot, synapse's Matrix Authentication Service gets an admin client for it on a mesh-only listener, and the gateway forwards the web digests at /d/*. The synapse side is in core catalog 0.8.3, which requires this release; an older toolkit keeps 0.8.2.
• Nothing to do for the rest: the next deployment apply keeps DOCKER_HOST in the deployment user's ~/.bashrc and links ~/deployment to /srv/paisans/<token>, and secrets rotate hands a shared secret to its provider before the consumer.

Everything in [0.3.0-rc.1] to [0.3.0-rc.13] still applies.

🤖 Generated with Claude Code

What's Changed

• Develop is 0.3.0-dev by @josephquigley in #547
• feat: keep DOCKER_HOST and ~/deployment in the user's shell by @josephquigley in #548
• Blueprints link optionally and share secrets; the engagement app runs the Digest Bot on Matrix by @josephquigley in #543
• Release 0.3.0-rc.14 by @josephquigley in #549

Full Changelog: v0.3.0-rc.13...v0.3.0-rc.14