v0.3.1

A patch release: the cursor agent preset was broken — now fixed and verified — plus a new agent-verification harness and a security-showcase demo.

Fixed

• sluice agent cursor was broken. The preset installed @cursor/cli, which 404s on npm — cursor-agent ships via Cursor's own install script, not npm. Switched to the script + a PATH symlink, and verified it installs and runs.

Added

• Agent-preset verification harness (test/verify-agents.sh + a manual verify-agents.yml). For each preset it builds the image and checks, with no credentials, that the CLI binary installs and runs, every declared API host is reachable through the proxy, a non-allowlisted host is blocked, and the auth env var is forwarded; the live authenticated round-trip is the only cred-gated step (auto-runs if the key is present, else skips). cursor, amp, and opencode are now verified cred-free; opencode's full live round-trip passes too.
• A firewall/exfil demo (examples/firewall.config.sh) — self-contained and non-server: it reaches an allowlisted host, then is blocked trying to exfiltrate a fake secret to a non-allowlisted host and to a raw IP, surfaced by sluice doctor and the at-exit hint. The threat model, runnable.

Changed

• Curated the demo gallery into a capability matrix — firewall / strudel / jupyter each show a different slice — and elevated the coding-agent section from a footnote. Trimmed the vite/next/fastapi starters (redundant with sluice init, which scaffolds them) to an init pointer.
• De-staled the strudel and jupyter demos (/home/node → /home/sluice, after the sandbox user rename).

Full changelog: v0.3.0...v0.3.1