Cloud-Visi v0.1.0-beta.3 — AWS evidence improvements

Source: 22344f62c0ea5bcddd89c15b933eb32575d3c162 (merged AWS fixes).

AWS and GitHub Actions

• Validate the existing AWS S3 state-reader and GitHub Actions path with a
  50-case campaign, six private fixture repositories and scoped replay tests.
• Recognize full-SHA artifact action pins and output-only plans behind canonical
  local composite wrappers, including reusable workflow forms.
• Report typed S3 region-routing failures and STS credential failures nested
  inside S3 reads with the correct explanation. Failed reads retain state history.
• Explain current GitHub delivery evidence and log coverage accurately; workflow
  success never implies Terraform apply or current cloud state.
• Reject parent-directory action paths and native shell steps that resemble local
  composites. Legitimate indented action inputs named shell remain supported.
• Add AWS/GitHub setup and evidence limits.

Upgrade and verification

• Parser version 13 applies to new successful reads; historical repair stays
  explicit and bounded. Preserve the database and matching encryption-key storage.
• Administrator sign-in and installation-bound trials continue from beta.2 with
  the same owner verification key. No schema migration or new runtime service.
• Final tested source: 2,117 Go pass events, 16 skips, zero failures across 28
  packages, with real-migration API coverage. Events include subtests/packages.
  Nine fixture tests, nine actionlint checks, Terraform formatting and server
  build pass. The merged main tree matches that reviewed/tested source exactly.
• The campaign's 50 cases are in Review, none Closed; overall independent
  acceptance is pending. Public gate/fork variants do not certify private
  features or first-time outsider behavior. Invalid-account refusal does not
  certify a successful cross-account read. Some controls are controlled replays.
• GitHub Actions coverage remains partial; DORA retains its Azure Pipeline limit.
  State is an observation, not continuous cloud health or apply causality.
• GCS, notifications, automatic remediation and OCI chart publication remain
  excluded. No new scale or vulnerability-free dependency claim is made.
• Published AMD64/ARM64 native runtime and bundled scanner checks pass; both
  architectures download anonymously. Beta.1/beta.2 are unchanged and beta
  matches the approved digest. No latest tag or OCI chart was published.
• See release verification and
  the completed release record.

Pull the released image

docker pull ghcr.io/cloud-visi/cloud-visi:0.1.0-beta.3

Linux AMD64 and ARM64 are available. Approved multi-architecture digest:
sha256:d41299fe9b15845491e579c808c9e16f8b8c95961574f33ca63cae6e86b80959.

Archive SHA256: 72380a0b11614e4766694b21f476ed1c8feb5c116b1093b153bc7c39ab1b24fa.

The beta alias matches this digest. Both architectures download anonymously.
Beta.1 and beta.2 are unchanged; latest remains absent and the OCI chart is
unpublished. Native publication and runtime verification:
https://github.com/cloud-visi/cloud-visi-deploy/actions/runs/39044313680.

The attached release record contains completed checks. Product source remains
private; automatic ZIP/tar.gz source links contain public deployment files only.