0.3.0:0

Update to upstream Spaces 0.3.0 and refresh bundled images (subs v0.1.2c,
certrelay v0.2.8, nacho v1.0.0b). Add Create/Show Registry API Keys for
registry-server, remove Configure Subspaces and SUBS_PUBLISH_REQUIRE_FINALIZED,
and align README/instructions with the new tags.

Co-authored-by: Cursor <cursoragent@cursor.com>

startos/utils.ts

@@ -74,6 +74,27 @@ export function randomPassword() {
   })
 }
 
+// Matches upstream docs: `openssl rand -hex 32` → 64 lowercase hex chars.
+export function randomApiKey() {
+  return utils.getDefaultString({
+    charset: 'a-f,0-9',
+    len: 64,
+  })
+}
+
+// registry-server refuses to start unless both keys are non-empty and different.
+export function generateRegistryApiKeys(): {
+  registryApiKey: string
+  subsdApiKey: string
+} {
+  const registryApiKey = randomApiKey()
+  let subsdApiKey = randomApiKey()
+  while (subsdApiKey === registryApiKey) {
+    subsdApiKey = randomApiKey()
+  }
+  return { registryApiKey, subsdApiKey }
+}
+
 // Banner box rendering for the gotty terminal MOTD. Canonical width is 100
 // monospaced cells: 1 cell each for the left/right side borders, plus 1-cell
 // gutters on each side of text, leaving 96 cells of usable text. All public