Promote stable workspace product for 3.0.0

Freeze the current workspace-first surface as the stable 3.0 contract and reposition the
landing docs, CLI help, and public contract around the stable workspace path after the
one-shot proof.

Bump the package and catalog compatibility to 3.0.0, add a dedicated workspace walkthrough
tape/GIF, and mark the 3.0.0 roadmap milestone done while keeping runtime capability
unchanged in this release.

Validation: uv lock; UV_CACHE_DIR=.uv-cache make check; UV_CACHE_DIR=.uv-cache make dist-check;
UV_CACHE_DIR=.uv-cache uv build; UV_CACHE_DIR=.uv-cache uvx --from twine twine check dist/*;
built-wheel CLI smoke for pyro --help and pyro workspace --help; vhs validate plus rendered
workspace-first-run.gif outside the sandbox because vhs crashes when sandboxed.

docs/roadmap/task-workspace-ga.md

@@ -2,7 +2,7 @@
 
 This roadmap turns the agent-workspace vision into release-sized milestones.
 
-Current baseline is `2.10.0`:
+Current baseline is `3.0.0`:
 
 - workspace persistence exists and the public surface is now workspace-first
 - host crossing currently covers create-time seeding, later sync push, and explicit export
@@ -37,16 +37,13 @@ also expected to update:
 5. [`2.8.0` Named Snapshots And Reset](task-workspace-ga/2.8.0-named-snapshots-and-reset.md) - Done
 6. [`2.9.0` Secrets](task-workspace-ga/2.9.0-secrets.md) - Done
 7. [`2.10.0` Network Policy And Host Port Publication](task-workspace-ga/2.10.0-network-policy-and-host-port-publication.md) - Done
-8. [`3.0.0` Stable Workspace Product](task-workspace-ga/3.0.0-stable-workspace-product.md)
+8. [`3.0.0` Stable Workspace Product](task-workspace-ga/3.0.0-stable-workspace-product.md) - Done
 9. [`3.1.0` Secondary Disk Tools](task-workspace-ga/3.1.0-secondary-disk-tools.md)
 
-## Definition Of Done For The Roadmap
+## Remaining Follow-Up
 
-The workspace product is ready to leave beta when:
+The core workspace product is now stable. The remaining planned follow-up is intentionally
+secondary:
 
-- the public contract is workspace-first rather than task-first
-- an agent can inhabit a sandbox through shell, exec, service, diff, export,
-  snapshot, reset, and explicit host-crossing operations
-- the main docs lead with the workspace product, not one-shot VM execution
-- the remaining deliberate deferrals are secondary disk tools rather than core
-  workspace features
+- `3.1.0` secondary disk tools for offline inspection and disk-level workflows
+- no further roadmap milestone changes the stable workspace-first core contract

docs/roadmap/task-workspace-ga/3.0.0-stable-workspace-product.md

@@ -1,5 +1,7 @@
 # `3.0.0` Stable Workspace Product
 
+Status: Done
+
 ## Goal
 
 Freeze the workspace-first public contract and promote the product from a