v0.3.0

⛔ **Breaking: `aihawk do` is gone.** It ran one task headless and printed the
answer. If you have it in a script or a cron line, that line stops working on
upgrade; pin `aihawk==0.2.0` if you need time. `runner.drive`, which only it
called, went with it.

There is one way in now, and it is `aihawk ui`.

**What did not go with it, because none of it was ever about the subcommand.**

`drive` was a `Link` opened and closed around a single task, so the two
key-isolation tests that ran through it were testing `Link` all along. They
assert against `Link` now, which is what the interface uses. A third was added
while moving them: the key must REACH the parent client. Without that one, a
version that scrubs the key everywhere passes the other two and cannot talk to
OpenRouter at all.

The command-line test file drove `do` from top to bottom and is now on `ui`.
Fifteen guarantees survived the move - where the key comes from, that an
`OPENAI_API_KEY` is not accepted as an OpenRouter one, that every option arrives
under the name the environment builder reads, that a bad option is a usage error
before anything connects, and that the key is never echoed on any path. Four
died with the command and are written down in the file so nobody hunts for them
later: `ui` requires no key, takes no task argument, and prints no result.

The end-to-end test used to invoke `aihawk do` against a live browser and a live
model. What it proved was the loop reading a page and answering, not the
subcommand, so it opens the same `Link` and runs the same loop. It was run for
real while being rewritten.

**Known issue.** The wiki still documents `aihawk do` on several pages,
including the cron and monitoring guides that are built on it. Those pages are
wrong as of this release and will be dealt with separately.