0.3.0:0

Update to upstream Spaces 0.3.0 and refresh bundled images (subs v0.1.2c,
certrelay v0.2.8, nacho v1.0.0b). Add Create/Show Registry API Keys for
registry-server, remove Configure Subspaces and SUBS_PUBLISH_REQUIRE_FINALIZED,
and align README/instructions with the new tags.

Co-authored-by: Cursor <cursoragent@cursor.com>

instructions.md

@@ -57,14 +57,32 @@ spaces walletbalance default
   `/data/mainnet/wallets/default` to `.bakNNN` suffixes so no prior state is
   lost, then calls `space-cli importwallet` and `space-cli loadwallet`.
   Requires the service to be running.
+- **Create Registry API Keys** — generates (or rotates) `REGISTRY_API_KEY` and
+  `SUBSD_API_KEY` for the Subspaces registry. Required before the registry
+  daemon will start.
+- **Show Registry API Keys** — displays the stored registry keys.
+
+## Subspaces registry API keys
+
+The embedded `registry-server` will not start without two distinct bearer
+secrets. Before enabling Subspaces (or when StartOS prompts you after):
+
+1. Run **Create Registry API Keys** — generates `REGISTRY_API_KEY` and
+   `SUBSD_API_KEY` (same shape as `openssl rand -hex 32`).
+2. In the Subspaces Web UI, open **Settings → Registry Server**, set **Auth
+   Token** to `SUBSD_API_KEY`, and click **Test**.
+3. Give `REGISTRY_API_KEY` to any intake client that calls `POST /register`.
+
+Use **Show Registry API Keys** to retrieve the stored values later, or re-run
+**Create Registry API Keys** to rotate them (then update the Auth Token).
 
 ## Limitations
 
 - **Mainnet only.** No testnet, signet, or regtest.
 - **Container images** (see also the package manifest): the `spaced` runtime uses
-  `horologger/spaces:v0.2.1a`; Subspaces, Certrelay, and Nacho use
-  `horologger/subs:v0.1.2b`, `horologger/certrelay:v0.2.7b`, and
-  `horologger/nacho:v1.0.0`.
+  `horologger/spaces:v0.3.0`; Subspaces, Certrelay, and Nacho use
+  `horologger/subs:v0.1.2c`, `horologger/certrelay:v0.2.8`, and
+  `horologger/nacho:v1.0.0b`.
 - The image's `docker_entrypoint.sh` is not used. `spaced` is managed by
   StartOS, not started inside a `screen` session by login.
 - The only externally bound port is `8080` (gotty). Spaced RPC stays on