Prepare ISRAS 0.1.3 release candidate

[kb2vhn]

Purpose

Stabilize the merged hosted-validation repair as the ISRAS 0.1.3 release
candidate.

Release boundary

This pull request:

• changes VERSION and validator identity from 0.1.2 to 0.1.3;
• moves the merged repair record from Unreleased into the dated 0.1.3 changelog;
• adds the 0.1.3 release notes;
• updates the current implementation and project-adoption status;
• records the exact unchanged six-asset release contract.

Included repair

• release-bound SSH signer trust before hosted repository validation;
• rejection of missing, altered, wrong-key, and wrong-principal trust;
• retention of both hosted evidence trees;
• correct GitHub Release asset-upload hostname and regression coverage.

Boundaries

This pull request does not:

• change the already-merged repair implementation;
• modify a consuming project;
• create or push isras-v0.1.3;
• build or publish release assets;
• create or publish a GitHub Release;
• move main;
• claim that 0.1.3 is published or adoption-ready.

A neutral clean-runner consuming-project fixture remains a separate
post-publication adoption-readiness gate.