Release v1.3.0

[bigbes]

This release introduces a new transaction-aware integrity API (Codec[T], Store[T], and Tx), a Prefixed storage wrapper for namespace scoping, a LayeredNamer with per-category key layout, and additional typed marshallers. It also bumps dependencies to address vulnerabilities reported by govulncheck.

Added

• storage.Prefixed: wrapper that scopes every storage operation, predicate, Range, and Watch call under a given namespace prefix. Nested wrappers are flattened automatically (storage: add Prefixed wrapper for namespace scoping #67).
• namer.LayeredNamer: namespace-agnostic namer that places each key category under its own top-level location segment (/<objectLocation>/<name>, /hash/<hashLocation>/..., /sig/<sigLocation>/...). Segments are validated at construction and ParseKey parses keys back to (name, KeyType, property) unambiguously (namer: add LayeredNamer for per-category key layout #68).
• integrity: new schema-driven API for integrity-protected storage. Codec[T] describes the value layout independently of any storage handle and is built via the fluent CodecBuilder[T], which validates location-override keys eagerly so typos like WithHashLocation("sah256", …) are no longer silently ignored. Store[T] binds a codec to a storage handle and exposes Get/Put/Delete/Range/Watch. Conditional multi-key updates are available through Tx with Branch and typed futures; multi-codec transactions are lowered to a single storage call (integrity: add Codec[T] and CodecBuilder[T] #69, integrity: add Tx, Branch, futures and Codec.Tx* methods #70, integrity: add Store[T] bound to storage #71).
• marshaller: TypedJSONMarshaller[T] for encoding/json-based marshalling and TypedBytesMarshaller passthrough for values already stored as opaque bytes (marshaller: add JSON and bytes passthrough marshallers #73).

Fixed

• Bumped google.golang.org/grpc to v1.79.3 (GO-2026-4762: authorization bypass via missing leading slash in :path) and go.opentelemetry.io/otel/sdk to v1.40.0 (GO-2026-4394: arbitrary code execution via PATH hijacking) (ci: add govulncheck workflow and fix reported vulns #75).