v0.3.0

CHANGELOG.md
is the readable account of what changed and why. The commit list below is
the complete one.

Changelog

• 16684ed feat!: read target paths the way scp and docker cp read them
• 0eebeff release: prepare 0.3.0

Verifying this release

Every archive ships reach plus the helper binary for each target platform.
At the helper tier reach copies that binary onto your target, so it is worth
knowing where it came from.

Check the contents against checksums.txt:

sha256sum -c checksums.txt --ignore-missing

And check that checksums.txt itself came from this repository's tagged CI
run. The release is signed with cosign keyless
signing, so there is no public key to fetch — the identity is the workflow
that built it:

cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp '^https://github.com/bojieli/agentreach/\.github/workflows/release\.yml@refs/tags/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Each archive also ships with an SBOM (.sbom.json, SPDX) listing everything
compiled into it.

Container image

The same build is on GitHub Packages for amd64 and arm64:

docker run --rm -v "$HOME/.ssh:/root/.ssh:ro" \
  ghcr.io/bojieli/agentreach:0.3.0 version

Nothing was published here until CI was green on this tag — every test on
every platform, the linters, the fuzz runs, govulncheck, the cross-compiles
and a full release dry run.