v0.10.3 — Self-host hardening, experimental local-docker sandboxes, and an auth refresh fix

Self-host hardening wave from the production-readiness audit, an experimental local-docker sandbox provider, and an auth refresh fix.

New

• Experimental local-docker sandbox provider for self-host — run agent sandboxes as plain Docker containers on the same machine as your Kortix instance, with no cloud sandbox account. All sandbox-facing URLs resolve over the Docker network. Listed last in the provider picker and not recommended for production: it builds sandbox images locally and is noticeably slower than Daytona or Platinum.
• Moving dev / staging / prod image tags — self-host instances can now track a channel-style tag (kortix self-host init --tag dev|staging|prod); CI re-tags the deployed build by digest, no rebuild.
• Smoother SSO/SCIM setup — mint the SCIM token and paste it into your IdP on one page, live SSO verification with a resume story, complete Directory Sync and Google guide screenshots, and a visible "Use single sign-on (SSO)" entry on the sign-in page.

Improved

• Self-host updater — resilient update runs with visible outcomes (kortix self-host status now shows the last update result), rotated container logs, and per-service memory limits so one service can't starve the box.
• Self-host EC2 (Terraform) — the data volume now survives instance replacement (AZ pinned to the subnet, not the instance), reboot-surviving bootstrap, containerd relocated to the data volume, and CloudWatch status/disk/memory alarms.
• Zero-downtime migration policy — every new database migration is linted by squawk plus deterministic mixed-version and enum-value guards in CI, with a rewritten migrations runbook.

Fixed

• Silent auth refresh — sessions renew in the background; an expired token no longer leaves a dead, blank page.
• Git PAT import — a saved managed-git personal access token is now recognized as a connected GitHub account, so repo import works without reconnecting.
• SCIM Tenant URL is now correct on same-origin and self-hosted deployments.
• Removed the legacy SANDBOX_IMAGE configuration surface from self-host.
• Scoped the ECS deploy role's describe/list IAM actions to Kortix ARNs.

What's Changed

• chore(release): VERSION → 0.10.3 [skip ci] by @github-actions[bot] in #4760
• feat(iam-web): complete the setup-guide screenshots + guard test by @Ino-Bagaric in #4767
• feat(iam-web): setup polish — live SSO verify, resume story, self-hosted SCIM fix by @Ino-Bagaric in #4768
• fix(iam): scope ECS deploy-role describe/list actions to kortix ARNs by @markokraemer in #4759
• chore(self-host): remove legacy SANDBOX_IMAGE surface by @markokraemer in #4758
• feat(ci): moving dev/staging/prod image tags for self-host tracking by @markokraemer in #4755
• fix(git): recognize a saved managed-git PAT as a connected GitHub account by @markokraemer in #4757
• refactor(db): zero-downtime migration policy — squawk + deterministic guards by @markokraemer in #4762
• fix(selfhost-ec2): data-volume survival, resilient bootstrap, containerd on data volume, alarms by @markokraemer in #4763
• fix(self-host): updater resilience, run visibility, log rotation, memory limits by @markokraemer in #4764
• chore(dev-eks): deploy dev-2081ad42 [skip ci] by @github-actions[bot] in #4770
• feat(sandbox): experimental local-docker provider (same-machine sandboxes) by @markokraemer in #4765
• fix(auth): silent token refresh + never render a dead auth page by @markokraemer in #4766
• fix(local-docker): resolve every sandbox-facing URL over the Docker network by @markokraemer in #4771
• chore(dev-eks): deploy dev-7e7cc29b [skip ci] by @github-actions[bot] in #4773

Full Changelog: v0.10.2...v0.10.3