v3.0.0

Runner v3.0.0

This breaking release defines HTTPS as the runner-facing transport. NATS
JetStream remains an internal, durable implementation detail behind the runner
gateway and is not exposed to runner agents or deployment Jobs.

Runner agents authenticate with short-lived Ed25519 JWTs and long-poll their
runner-specific HTTPS endpoint. Deployment Jobs use deployment-scoped tokens
to download bundles and upload results and bounded encrypted logs. Commands
remain durable while an agent is offline, and encrypted delivery receipts let
any gateway replica acknowledge, retry, or reject a command without sticky
sessions.

The runner image now supports the central and protected-side gateway processes
in addition to agent and deployment execution. Central deployments should run
at least two stateless gateway replicas. A separate public gateway URL is used
for external and ECS Jobs, while directly scheduled Kubernetes Jobs can use a
cluster-internal Service URL.

Edge mode adds a persistent HTTPS outbox for results and encrypted logs when
the return path is unavailable. Multi-node installations require shared
ReadWriteMany storage. Air-gap mode places a gateway and JetStream inside the
protected compartment and exchanges signed files through the boundary. A
separately authorized reverse relay is required to return results and logs; a
physically one-way diode cannot provide that path.

Use Kubernetes runner chart 0.3.0 and data-plane v3.0.0. Do not mix this
runner with the v2 data-plane or the 0.2.x runner chart.

The simple and edge paths were exercised locally with real JetStream, two
gateway replicas, and a Kind runner that deployed a real Kubernetes resource.
The physical diode path and live ECS execution were not qualified. Logs remain
bounded encrypted objects; this release does not add live log tailing.