v1.3.0 — independently-built component images

Third repo onto the model, third finding — a guard that was right for the case it was written against and wrong for the next one.

The problem

release-image required every image in a release to resolve to one build commit. Correct for Atlas: one workflow builds the SPA and its sidecar, so a mismatch means a half-updated pair shipping under a single version.

VirtualWindow builds its two images from disjoint path filters — prototype/+docker/ versus config-service/. They change independently and are almost never built by the same commit; right now they sit 5 commits apart. Under the strict rule the repo could not be released at all.

The change

require-same-commit, default true, so repos that need the check keep it. Opting out drops only the all-from-one-commit constraint — each image is still verified against the branch history, so a stale build or one from another branch is still refused — and the tag lands on the newest resolved commit rather than the oldest, which would name a commit predating shipped code.

Minor: callers gain an input some of them need; nothing breaks for a caller that omits it.