v1.3.0

• Use beacon-java as the Gradle root project name in build output and CI summaries.
• Security now exports a finding occurrence for every request that triggers it, preserving trace
  correlation independently of full-evidence sampling. Sampled-out evidence is explicitly marked;
  consumers must honor evidence_sampled and truncated. Log volume can increase for repeated findings.
• Security findings now carry request-specific attack evidence independently of code risk. Bounded
  analysis supports an opt-in ANSI SQL lexical subset and simple POSIX shell scripts; unsupported
  syntax, imprecise taint, and missing boundary policies remain unknown. No result claims successful
  exploitation. Stronger evidence bypasses ordinary sampling and is retained across later ordinary requests.

Release evidence

• Source commit: 9f568cbdf60f1ffc1c73e124fb7cbcf7c137927b
• Full validation: https://github.com/beacon-observability/beacon-java/actions/runs/39263160430
• Agent SHA-256: 31154913f77156d3c456022ced47927e7e24c18fd29f00a5a80e5cec899f50fa
• The attached JAR is the exact candidate tested by this release workflow; the publish job does not rebuild it.