v1.3.0

What's Changed

• Update development toolchain to resolve audit advisories by @conorbronsdon in #131
• Reject symbolic-link draft input files by @conorbronsdon in #132
• nightly: current container image pin, plus two stranded 9/15 fixes (CLI statistics category, footnote export) by @conorbronsdon in #134
• nightly-deep: test readBoundedFile's link and identity checks, document the refusal by @conorbronsdon in #135
• chore(deps): bump hashgraph-online/ai-plugin-scanner-action from 1.2.653 to 1.2.685 by @dependabot[bot] in #133
• Require a canonical 64-byte sha512 digest in release-state by @conorbronsdon in #136
• Release 1.3.0: analytics, public reader tools, draft tags and keychain storage by @conorbronsdon in #141
• feat: draft-only tag assignment with dry-run and readback (#50) by @conorbronsdon in #137
• feat: publication stats, growth sources and exact post analytics (#52) by @conorbronsdon in #138
• feat: anonymous public reader tools for profiles, Notes and archives (#51) by @conorbronsdon in #139
• feat: opt-in OS keychain credential storage (#53) by @conorbronsdon in #140

Full Changelog: v1.2.1...v1.3.0