v0.3.0 — platform source parity + hardening

What's new

This release brings the open-source platform current with upstream development and hardens the release pipeline.

Full platform, caught up

The complete single-tenant platform source is now in sync with the development line:

• Stateless host lifecycle — idle hosts drain (reversible fence), suspend to zero replicas, and wake on demand; session state persists on the workspace PVC.
• Host-Context-Controller — a dedicated Kubernetes API client + CommunicationChannel watch-recovery.
• Registry connection mode — per-deployment registry connect + proof-of-possession signing, with a Control UI connect panel.
• Teams as a communication channel alongside Telegram / Email / Slack.
• SSRF hardening — http_request blocks private and cloud-metadata IP-literal targets (169.254.169.254, 127.0.0.1, [::1], …), not just DNS-resolved hosts.

Docs

New how-tos: connecting to and publishing on the registry, the MINIKUBE_MEMORY workaround for the 10 GB quickstart gotcha, and shared vs. global files.

CI / supply-chain hardening

The public build now fails if internal working artifacts or non-executable scripts are ever committed, and the publish tooling guards against leaking real identifiers, PII, and internal operational detail.

Install the CRDs

```bash
kubectl apply -f crds.yaml # attached — 8 clerum.io CRDs + WRC trigger RBAC
```
Or via the chart: `helm install clerum-crds ./charts/clerum-crds`.

Compatibility

`clerum.io/v1alpha1` remains alpha — breaking schema changes ship with migration notes.