chore(main): release 3.0.0

[github-actions]

🤖 I have created a release beep boop

3.0.0 (2026-08-07)

⚠ BREAKING CHANGES

• acq: on a host with both backends installed and no explicit selection, acq now resolves to msb instead of sbx.
• acq: opencode-web.sh is removed. Use the openchamber acq kit to run OpenCode in the browser.

Features

• acq: default to msb backend and remove qsbx for 3.0.0 (#266) (21f7901)
• acq: detect stale sandboxes + acq kit check|update (#236) (#241) (f1693aa)
• acq: fix subcommand dispatch hygiene and implement 'secret import' (#283) (5ae27c6)
• acq: sand rough edges off first-run onboarding (PATH self-repair + auto host check) (#281) (71698d7)
• acq: sbx↔msb backend parity, incl. live openchamber-on-msb (omnibus #234) (#233) (32f9ae0)
• acq: scope GitHub token per-sandbox to mounted repos (#229) (b355706)
• msb: re-run kit startup on restart via acq start/restart (#260) (7bbc999)
• msb: stage kit startup commands as a create-time script (#259) (3ff736b)
• progress: TTY-aware progress feedback during long acq run phases (#290) (ab44206)
• sbx: add actions=read scope to PAT URL (#262) (fbaa291)

Bug Fixes

• acq: accurate git-identity guidance + workspace path pre-flight (#216) (546cc93)
• acq: carry publishedPorts and quote allow hosts in kit-translate (#221) (a36d783)
• acq: don't hang key rotation when sbx needs a login (#211) (#212) (bb0544d)
• acq: enumerate keychain-linux secrets in acq secret ls (#258) (f4e1bb9)
• acq: intercept --kit <ref> on run/create and translate it (#223) (a86d151)
• acq: make kit fetch non-interactive; never prompt for git creds (#207) (#209) (b505336)
• acq: make USAi key rotation backend-neutral (#218) (4a5f8e1)
• acq: run fails closed on an unresolvable target instead of silent no-op (#257) (c0b155c)
• acq: store USAi key before sandbox create to end 200-vs-401 split (#286) (c68ccb6)
• Add -f to sbx rm command to cleanup rotation validation sandbox (#268) (6a21e48)
• msb: install/launch the agent + mount workspaces at their host path (#230) (0d2bbd0)
• opencode-web: background sbx exec command on host instead of opencode command inside sandbox (#210) (0a2057e)
• opencode-web: use serve command and drop per-run port publish (#204) (5364ffb)
• sbx: correct lifecycle verbs — sbx has no 'start'/'restart' (#285) (b69b5d1)

---

This PR was generated with Release Please. See documentation.