chore: move to start-sdk 3.0.3; 1.162.0:0 → 1.162.0:1

[MattDHill]

The SDK 3.0.3 migration, plus the confirmation and description fixes that ride along with it.

• start-sdk 3.0.3. The lock is resolved against the live registry (npm audit 0). The toolchain the SDK now supplies is dropped, and .prettierrc names the SDK's shared config.
• File models are z.looseObject. homeserver.yaml is Synapse's own file and carries keys this package doesn't model. Under SDK 3 a z.object shape would delete every one of them on the next merge(), which main runs on every start.
• Dependencies: Coturn moves from the manifest and setupDependencies into an sdk.Dependencies builder as optional, running and without health checks, enabled by the Config action's Voice and Video Calls toggle. That is the same conditional requirement as before, now published in the manifest.
• pg_restore's unbounded timeout moves into the exec options; the positional argument is gone in SDK 3.
• The server name stays an install-only identity. It is not converted to setupPrimaryUrl, because it is baked into every user ID. Its picker now starts empty (default: null), so the permanent name is always chosen deliberately rather than taken from whichever domain is listed first.
  • Once a name is set, the action refuses any other ("This server is X, which can never change"), and its warning names the server.
  • init/watchServerName.ts raises the critical task while the name is unset or its domain is missing from the Homeserver interface, naming the domain to add back, and clears it otherwise. Box-verified: update from :0 keeps running; removing the domain stops Synapse with the task; re-adding it clears the task.
• Confirmations. Set Admin Password asks for confirmation only when it replaces an existing password. Its first run, from the setup task, does not. store.json's adminPasswordSet tracks this: an import counts as set, and an existing install (no key) still confirms.
• Delete Appservice preselects nothing, so a destructive pick is always deliberate.
• Option descriptions. Log Level, Registration, Federation, Large Room Protection, Thumbnails, Rate Limits and Discoverability list what each option does. Max Upload Size and Rate Limited now guide rather than caption.
• Release notes keep 1.162.0:0's notes above this revision's bullets.
• Fixes:
  • The server-address description used two different example domains, and misspelled "address".
  • The Federation description said "vica versa".
  • Eight dead i18n keys are removed.
• Workflows synced to the package template (ready_for_review, pr-retarget.yml). AGENTS.md resynced and its repo section trimmed to four rules. The README is updated for the confirmation change, the empty server-name picker and the import model's strictness.

🤖 Generated with Claude Code

[helix-a]

Reviewed the SDK 3.0.3 migration, dependency declaration, loose file-model schemas, exec timeout options, server-identity watcher and confirmation changes. No correctness regressions found. Merge-tree is clean and the SDK pin matches npm latest.

Reused successful CI run 37534308101 at 0d9d1d7: type-checking, formatting, bundling and both architecture package builds passed. Runtime testing was not repeated.

Helix-Harness: pi
Helix-Model: openai-codex/gpt-6.1-sol