release: v1.3.0 optional Coworker context

[jeffhuber]

Code Mower v1.3.0 adds optional Coworker organizational context while preserving the default Claude/Codex setup. This release preparation pins 1.3.0 consistently, documents account-bound delivery and context-aware review, and adds the sanitized qualification scorecard for epic #868.

The bounded pilot used two frozen PR cases owned by an existing lane. All six Claude/Codex recipient roles received identical authorized evidence; replay survived process restarts and authorization was checked again before saving private feedback. One case added no actionable constraint. The other found a related-control terminology difference that source inspection confirmed; it raises an owner consistency question, not a new patch requirement. No private PR/Jira mutations or measured productivity gains are claimed. Provider retrieval cost remains unknown.

Closes #875. All implementation dependencies C1–C6 are merged with independent Code Mower review and green gates. Graphify remains a separate v1.3.x candidate under #876.

Validation: release-readiness, 236 release-hygiene tests, Ruff, privacy, compileall and no-provider smoke pass. Full local regression passed (2,795 tests). Cold-clone and package-install rehearsals passed, including all ten first-user readiness checks. Python 3.12–3.14/package CI and code-mower/gate passed. Independent Code Mower Claude audit PASS with no findings at 40a35ac. No-publish release workflow 34659139487 built and verified distributions successfully. Publication and installed-package qualification follow only after this PR passes the normal gate; v1.3.0 is not yet published.

[jeffhuber]

Claude audit (merge-authority lane)

Head SHA: 40a35ac877db34bcf49b17a0083bbcd19757a813
Findings: P0=0, P1=0, P2=0, P3=0 (blocker policy: any P0/P1/P2 -> BLOCKED)

Claude Audit: PASS

Summary:

This is a mechanical v1.2.2→v1.3.0 release bump: version strings in pyproject.toml/init.py, CHANGELOG/README/docs updates, two new release/qualification docs registered in package_manifest.py, and matching test_release_hygiene.py assertion updates. Version, tag, and package-spec references are consistent across pyproject.toml, init.py, CHANGELOG, docs, and workflow templates (both root and src/code_mower copies updated identically). New doc content (v130-release-notes.md, v130-context-qualification.md, context-provider-contract.md edits) matches the trusted plan-of-record context verbatim, with historical release-notes links preserved rather than replaced. No functional code paths, validation logic, or security-relevant behavior are changed in this diff.

Findings: none.