chore(release): bump version to 0.1.3

[AndyBoWu]

Summary

Releases the fix batch merged since 0.1.2 (2026-09-01) as 0.1.3 — 31 commits, all fix/docs/chore, no features or breaking changes, so a patch bump.

• pyproject.toml, psdn_sonar/__init__.py, and a regenerated uv.lock (version line only) declare 0.1.3.
• CHANGELOG.md: the [Unreleased] section becomes [0.1.3] - 2026-09-27, with the entries that were missing for [Bug] Two config failures in psdn-sonar custom arrive as tracebacks: a YAML parse error escapes, and a bare dataset key skips the validation written for it #277, [Bug] test_noop_on_posix does not pin os.name the way its siblings do, so it fails on Windows on every supported interpreter #278, [Bug] The ffmpeg DLL registration takes the first match on PATH, so a host that installed both builds the README names can still fail to decode #279, [Bug] The test suite pins no matplotlib backend, so a plot test fails per full run on a host with an interactive default and a different one each time #280, [Bug] A prewarmed quality model can be built on the meta device, so every score fails silently and its columns are empty #288, [Bug] WER and CER are capped inside the POSEIDON composite but published raw, so a score cannot be checked against its own components #291 and [Bug] The hypothesis script check runs over a whole batch, so a single transcript in another writing system leaves no trace #292.

This must be the last merge before v0.1.3 is tagged — the release verifier requires the candidate to be the current tip of main.

Scope

• Documentation-only change
• Repository operations / automation change
• Code change
• Data, model artifact, generated output, or sample asset import
• Curated synchronization from the canonical development source

Public-safety checklist

• I did not add private repository names, private paths, private bucket names, raw transcripts, credentials, tokens, or internal system references.
• I reviewed the change for secrets and sensitive personal information.
• If this PR imports code, data, artifacts, generated output, or sample assets, it follows the import gate in docs/import-gate.md. — n/a, no import.
• If this PR is a synchronization, it includes the exact tracked-file allowlist, public sync record, dry-run result, and named maintainer review required by docs/upstream-sync-policy.md. — n/a, not a synchronization.
• License and data-rights expectations are documented for any third-party or generated material. — n/a.

Validation

• I ran the relevant local checks, or this change does not need local execution.

Notes: uv lock --check in sync; make pre-commit-run clean; full pytest 1530 passed / 49 skipped; local pip-audit run of the locked graph: 10 findings, all covered by reviewed exceptions (review-by 2026-10-15).