Release v1.0.3

Closes #99

Hardens the window in which Ante 1.0 still accepts invitation tokens issued before isolation (no iss/aud). No configuration, contract or storage changes.

Fixed

• Security: a deployment that sets Ante:Invitations:Token:Issuer or Audience explicitly no longer accepts tokens without those claims. This restores the pre-1.0 behaviour, where tokens signed with a trusted key but not naming this deployment were refused, even if that key was shared with another deployment.
• Ante no longer resolves a scoped MongoDB collection from the root service provider to load the upgrade window. Development's scope validation rejects that, and it bypassed per-tenant resolution.
• Rolling upgrades: tokens that replicas still running 0.x issue up to 15 minutes after the first 1.0 replica starts are still accepted, and keep their full lifetime.
• A token without an issue or expiry time is refused, and a pre-isolation token's lifetime may not exceed the configured Expiry.
• The end of the window is now recorded (legacyUntil) when a deployment first starts with isolation, so a later change to Expiry no longer moves it. Documents written by 1.0.0 fall back to activation + grace + current Expiry.

Local: Tier 1 PASS, Integration 107/107 (before the last main merge). Reviewed with Anthropic models only (same-provider review, no cross-provider check).