[obasilakis]

Summary

Sets VERSION and the DigitalOcean create script's default image tag to 1.0.0-rc3, ahead of tagging v1.0.0-rc3 on dev.

• VERSION: 1.0.0-rc2 → 1.0.0-rc3
• scripts/deploy/trinity-do-create.sh: TRINITY_IMAGE_TAG default v1.0.0-rc2 → v1.0.0-rc3 (pinned to VERSION by tests/unit/test_2380_installer_release_pin.py)

Release-candidate scope

• The tag goes on the dev tip after this merges. main is untouched and there is no release PR.
• No issues are closed and no status-in-dev labels change.
• publish-images.yml publishes v1.0.0-rc3 and 1.0.0-rc3 to GHCR. latest stays where it is: the type=raw,value=latest entry carries !contains(github.ref_name, '-').

Pre-release checks

• 44 commits on dev since v1.0.0-rc2.
• No open P0 outside status-in-dev.
• Secrets scan over v1.0.0-rc2..dev: clean.
• Enterprise submodule pin f8d1d3c equals enterprise main; no pointer bump needed.

Test plan

• tests/unit/test_2380_installer_release_pin.py: 2 passed

🤖 Generated with Claude Code

[dolho]

/review on 007b4c778: approve

Scope: clean. Two lines, both exactly as described: VERSION 1.0.0-rc2 → 1.0.0-rc3, and trinity-do-create.sh's TRINITY_IMAGE_TAG default v1.0.0-rc2 → v1.0.0-rc3. The branch is 1 commit ahead of dev, 0 behind.

Claims verified:

• Pin guard: tests/unit/test_2380_installer_release_pin.py gives 2 passed locally (it ties the installer default to VERSION).
• latest stays put: publish-images.yml:200 is type=raw,value=latest,enable=${{ … startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-') }}, plus flavor: latest=false. So the v1.0.0-rc3 tag publishes v1.0.0-rc3 / 1.0.0-rc3 only, and hosted installs on latest don't move.
• Enterprise pin: src/backend/enterprise on this branch is f8d1d3cf8, which is enterprise main. No pointer bump needed.
• Open P0s: #3106, #3012 and ent#849, all status-in-dev. None is outside in-dev, as stated.
• Tag: v1.0.0-rc3 doesn't exist yet, so nothing collides.

One note for RC3's scope (not a blocker for this PR): ent#849 is labelled status-in-dev, but its enforcement isn't in RC3. The public seam (#3428) is on dev, but the enterprise provider is ent PR #853, which is still open, and the pinned enterprise commit f8d1d3c has no email_code_allowed. With no provider registered, login_policy_gate allows every code through. So on RC3, unchecking "Keep email-code sign-in available for users" still changes nothing. Either:

• release-note it, or move ent#849 back to in-progress until #853 merges and the pointer is bumped; or
• merge #853 and bump the pointer before tagging, if it's meant to be in this RC.

Whoever re-tests the SSO row on RC3 should expect the old behaviour.

CI: 9 passed, 6 still pending at review time. Tag once they're green.

🤖 Generated with Claude Code