chore: prepare v1.3.0 release

[klboke]

Summary

Prepare kkRepo v1.3.0 from main cb8c6fb: unused blob-store configuration deletion, opt-in public HTTPS content redirects, resizable Browse panes, and npm/PyPI/Maven correctness fixes.

Synchronize Maven, Docker, Helm appVersion, quickstart/scanner defaults, runtime expectations, and bilingual deployment guides. Document unchanged Flyway V59, recovery for previously affected PyPI imports, and the limits of blob-store deletion and redirect opt-in.

Validation

• Local release checks passed: Maven validation, Helm lint, both Compose databases with/without the security-scanning profile, scanner isolation, quickstart runtime/data permissions, Flyway V59 parity, and diff checks.
• CI passed on final head 7617a1f.
• CodeQL passed on that same head for Actions, Java, JavaScript/TypeScript, and Python. All four analyses were uploaded without errors or warnings. The previous managed run stalled before two jobs received runners and could not be retried; an empty commit triggered a fresh successful scan. No security rules or coverage were reduced.
• Full E2E passed: 34 successful jobs and 17 intentionally skipped wrappers, including the complete real-client/cleanup coverage gate. A Nexus 3.77.2 fixture-creation HTTP 400 did not recur on a selective retry.
• Full E2E tested e763133. The final head is an empty child commit: both have exactly tree 72efee744d1318fb0c80f529d0fe76aa65199fe4, with no changed files. The run-full-e2e label was removed before reopening the PR to avoid duplicate healthy matrices.
• Codecov processed all three reports: base and head both have 835 files, 85,522 lines, 74,484 hits, and 87.09% coverage. Its GitHub project check remained in progress after processing; publication proceeded with the owner's explicit approval. No threshold or security policy was relaxed.

Published release and verification

• Published kkRepo v1.3.0 as Latest, with all seven assets. The tag points to merged commit 48dbea509fcae85461d371670c688d497ccfc043, whose tree matches the tested candidate.
• Merged-main CI, CodeQL, Release Packages, and Deploy Dev all passed.
• Downloaded all seven assets anonymously from their public URLs. SHA-256 checks, GitHub asset digests, and byte-for-byte comparison against the workflow artifacts passed. JVM/Native amd64/Native arm64 tar and zip payloads match; archive paths, executable scripts, Boot launcher, and Native ELF architectures were verified.
• Published JVM 1.3.0/latest, Native 1.3.0-native/native-latest, and scanner 1.3.0. Anonymous GHCR access and Linux amd64/arm64 manifests passed for all three. Moving aliases match their versioned manifest digests. The JVM images contain the exact JAR from the release workflow.
• Public amd64 JVM images upgraded the same isolated MySQL and PostgreSQL databases from 1.2.1 to 1.3.0. Public Native images then passed startup on both databases. Readiness was UP, Admin/Browse returned HTTP 200, and Flyway remained at V59.
• Public ARM64 JVM and Native images passed real startup, readiness, UI, and V59 checks against an isolated MySQL database. ARM64 emulation required a longer startup allowance than the initial old-version baseline probe; this was not treated as a product regression.
• Scanner amd64/arm64 liveness checks passed with database auto-update disabled. This does not assert vulnerability-database readiness or scan results.
• Temporary verification containers, their anonymous database/scanner volumes, and test networks were removed. Unrelated local instances and the user's primary checkout were preserved.

Upgrade reminder: there are no new database migrations since 1.2.1. Previously affected PyPI imports are not repaired automatically; follow the empty-target reimport instructions in the release notes.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-08T15:31:32.889934Z	7617a1f	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.09%. Comparing base (cb8c6fb) to head (7617a1f).

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #391   +/-   ##
=========================================
  Coverage     87.09%   87.09%           
  Complexity     1500     1500           
=========================================
  Files           835      835           
  Lines         85522    85522           
  Branches      15194    15194           
=========================================
  Hits          74484    74484           
  Misses        11038    11038           

Flag	Coverage Δ
server-smoke-mysql	13.87% <ø> (ø)
server-smoke-postgresql	13.88% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[klboke]

Release gate update: CI passed on e763133. Full E2E is still running; one Nexus 3.77.2 migration lane failed during Conan proxy fixture creation (HTTP 400), before migration assertions. Its logs have been retained for diagnosis and a selective retry after the matrix completes.

The managed CodeQL run 37798418510 is marked failed although its Java and JavaScript jobs never received runners and remain queued, with no steps or annotations. Python and Actions analyses passed. GitHub rejects workflow/job retries for this dynamic run; resubmitting the unchanged default-setup configuration returns its previous validation record rather than scheduling a new scan.

Publication is on hold until CodeQL completes successfully on the release candidate and CI/Full E2E are green. No scan languages, query rules, or branch protections have been weakened.

[klboke]

Release approval: proceed despite the stale Codecov project check. Codecov has completed all three reports; base and head both contain 835 files, 85,522 coverable lines, 74,484 hits, and 87.09% coverage. The GitHub check has not received the terminal state. CI and all four CodeQL analyses passed on 7617a1f; Full E2E passed on the identical Git tree. No unresolved review threads remain. No coverage thresholds or security rules were changed.