chore(release): prepare v0.20.3 - #2827

Requested by Михайло · project thread

What changed

Patch release v0.20.3 (20 PRs since v0.20.2). Version bumped across workspace, path-dep pins, npm packages, Cargo.lock, auxiliary lockfiles (fuzz, hyperlight) and doc snippets; CHANGELOG entry added.

Highlights:

• markkit / fetchkit builtins (opt-in features), on markkit 0.3.1 / fetchkit 0.7.1 for RUSTSEC-2026-0436 (feat(builtins): add markkit and fetchkit builtins with the upstream CLI #2803, fix(deps): bump markkit to 0.3.1 and fetchkit to 0.7.1 for RUSTSEC-2026-0436 (calamine) #2823)
• Fewer round trips and bounded memory for tree walkers on remote filesystems (fix(fs): cut round trips for rg, find and tree walkers on remote backends #2816, fix(builtins): list ls -R and tree through bounded bulk walk batches #2819, test(fs): large-tree stress tests; stream rg's walk, cap ls -R at the stdout limit #2820, fix(fs): walk directories in path order so prefetch matches consumers #2821)
• Execution::output_file and Deep Agents native output offload (feat: tee execution output to a VFS file; native capture offload for Deep Agents #2818)
• Deep Agents per-call timeouts, binary reads, error codes, guide (feat(python): per-call timeout and multimodal reads for the Deep Agents backend #2817, docs(python): add Deep Agents integration guide #2824)
• Python interpreter-exit crash fix (fix(python): drain abandoned callback dispatch before interpreter exit #2802)
• crates.io trusted publishing via OIDC (ci(release): use crates.io trusted publishing #2801)

Why

User-requested patch release.

Before / After

Publish-readiness report:

• cargo publish --dry-run -p bashkit-cpython-wasm -p bashkit -p bashkit-cli -p bashkit-scripted-tool: all four packaged and verified (exit 0)
• bashkit-cpython-wasm-0.20.3.crate: 8,159,915 bytes (< 10 MiB)
• Registries currently at 0.20.2 (crates.io, PyPI, @everruns/bashkit, @everruns/bashkit-wasm); 0.20.3 is greater
• cargo metadata --locked passes for fuzz, hyperlight, hyperlight/host
• check_doc_links.py: OK; check_workflow_parity.py: OK; cargo fmt --check: OK
• just apidocs: no drift (Python and TypeScript)

Risk

• Low (version/changelog only)
• First crates.io publish through OIDC trusted publishing (ci(release): use crates.io trusted publishing #2801): if trust config or the release environment is missing, publish.yml fails and needs a re-run after fixing config.

Checklist

• Tests added or updated (n/a, release prep)
• Backward compatibility considered