release: recover PHP SDK 1.3.0 publication

[roncodes]

Purpose

Restart the still-unpublished 1.3.0 release from current main, including the workflow repairs merged in #13. The earlier #11 release attempt did not publish a tag or package. The latest published version remains 1.2.0.

Changes

• Refresh the 1.3.0 changelog date and document the validated Xdebug pin and release-detection retries.
• Update the release notes and checklist to identify this recovery branch and its fresh release run.
• No SDK source, dependency, contract, or public API changes beyond the already-reviewed main branch.

Validation

• Local release identity check accepts 1.3.0 against latest tag 1.2.0.
• All 11 offline release-detection regression tests pass.
• Main CI passed after fix: stabilize coverage and release detection #13, including the repaired coverage and mutation jobs.
• This PR must pass its own full required checks, including the release-candidate dry run and disposable SDK contract, before merge.

Merge behavior

Merging this exact release/1.3.0 branch into main triggers a fresh Release workflow using the repaired detector and pinned Xdebug 3.5.3. It derives version 1.3.0, reruns the live contract and release validation, then proceeds through the existing protected release environment to publish the immutable tag and verify Packagist installation.

Do not rerun the old workflow, manually create a tag, or bump to 1.3.1. No published tag is being reused or replaced. This PR is prepared for maintainer review; no merge or publication has been performed.

[roncodes]

Recovery candidate verification for 281a874:

• 30 GitHub checks passed, including release-candidate dry run, PHP compatibility matrix, quality, security, and mutation.
• Coverage: 37 tests / 4,628 assertions; 1,110/1,110 lines and 1,043/1,043 branches covered.
• Mutation score: 88.18%, above the unchanged 85% requirement.
• Downloaded the fresh release-candidate artifact and verified both SHA256SUMS entries. The 1.3.0 source archive passes inspection: 138 files and no forbidden development state.
• All 11 release-detection regression tests passed locally and in CI.

The sole remaining check is the disposable Official Postman and SDK contract, currently in its non-interactive installer stage: https://github.com/fleetbase/fleetbase-php/actions/runs/34434853871

Merge only after that check succeeds and review is complete. This recovery PR is the release trigger; no additional branch preparation or manual tag creation is needed. Merging reruns release validation and the live contract before publication through the existing release environment.