[Chore] Prep minor release notes for 0.3.0

[roomote-roomote]

Opened on behalf of Matt Rubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

Related issue

N/A — requested in Slack to kick off another minor release.

Why this PR exists

• A maintainer explicitly invited this PR in the linked issue or discussion
• I am a maintainer / this is internal Roomote work

What changed

Adds nine pending changesets (2 minor, 7 patch) for user/operator-facing work merged since product version 0.2.0. No product code, CHANGELOG.md, or package.json version edits — CI will own the version bump after merge.

Expected next version: 0.2.0 → 0.3.0 (highest pending level is minor; no other changesets were pending).

Minor changes (preview of the CHANGELOG section)

• Tasks can go to sleep early from the task page overflow menu (Sleep above Delete). The action is available for snapshot-capable runs and for resumable Docker/Blaxel standby, so operators can release an awake environment without waiting for the keepalive timer.
• Local Docker tasks now retain idle containers and resume them in place with bounded cleanup (default 10 retained containers, 24-hour max age; max count 0 disables retention). Blaxel standby retention is likewise bounded (defaults 25 / 168 hours), with env knobs DOCKER_STANDBY_MAX_* and BLAXEL_STANDBY_MAX_* documented for operators.

Patch changes (preview of the CHANGELOG section)

• PR review notification updates treat failing CI checks and live merge conflicts as high-signal blockers: triage copy names the problem and offers a fix or conflict resolution instead of burying it after a soft "looked good" wrap-up.
• Main GitHub PR review summary comments now show a compact status footer with the review phase and short commit SHA (Reviewing abc1234 / Reviewed abc1234), using a linked SHA when a commit URL can be built.
• The worker common env file (~/.roomote/env.sh, which holds deployment secrets such as cloud tokens) is written owner-only (0o600) with ~/.roomote locked to 0o700, so other sandbox users cannot read those secrets.
• Signed public artifact raw URLs (allowlisted images and videos used for visual proofs and PR embeds) expire 30 days after they are signed, and cache headers stay within the remaining TTL, so a leaked screenshot link cannot be fetched indefinitely.
• Local Docker development rebuilds worker images that lack current networking tools before launching tasks, routes sandbox HTTP/WebSocket traffic through the public app edge so tunneled clients get a usable live session, and marks preview auth cookies Secure when using SameSite=None and Partitioned so iframe previews authenticate reliably.
• Docker and Blaxel standby environments can resume even when they were suspended before the first agent harness session, so early-sleep retains come back to Idle without forcing a new session create path.
• Blaxel sandbox lifecycle is more resilient: deterministic external IDs with idempotent create, bounded retries on readiness-sensitive calls, reuse of preview resources across standby/resume instead of delete-and-recreate, and immediate failure on non-retryable 4xx errors.

Covered by the notes: #219–#220, #222–#231, #233 grouped into the bullets above (Sleep + Docker/Blaxel retention as minor; review UI polish, security, resume/lifecycle as patch).

Skipped for the changelog: #218 LCP logo prioritization (pure performance polish), #221 typed runtime scalar normalization (internal retention path fix), #232 test-fixture identifier scrub.

Impact

Merging this PR does not bump the product version by itself. Once these changesets land on develop, CI opens or refreshes the Release Roomote 0.3.0 Version PR, which is what actually updates package.json / CHANGELOG.md and starts the promote path.

How it was tested

• Cross-checked root package.json 0.2.0, tag v0.2.0, top of CHANGELOG.md, and version-bump commit 1cd5df45 on develop
• Reviewed git log 1cd5df45..origin/develop --oneline --first-parent and each PR body for user/operator impact
• Confirmed no prior pending .changeset/*.md files beyond README
• Confirmed computeNextVersion('0.2.0', ['minor', 'patch']) → 0.3.0
• Pre-push hooks (lint:fast, check-types:fast, knip) passed on this changeset-only branch

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset (this PR is the changeset authoring)

[roomote-roomote]

No code issues found. This changeset-only PR adds 9 release notes (2 minor, 7 patch); I verified they parse, map to merged PRs #218–#233, and bump 0.2.0 → 0.3.0. See task

_{Reviewed 9a6a699}