Release v1.3.0

<!-- New release sections are prepended below this line by `make release`. -->

## 1.3.0 (2026-06-17)

#### Added

- feat(renovate): renovate-bot-rotate — atomic token rotation ([0089d52](https://code.stanford.edu/iac/cloud-framework/-/commit/0089d5225ed1698eb4080b31b09fb9d926c01aea))

- feat(renovate): add RENOVATE_TOKEN_VAULT_PATH to the token resolution chain ([26170bd](https://code.stanford.edu/iac/cloud-framework/-/commit/26170bd710ecc48fe05bc044b7e52b8115d4b841))

- feat(renovate): sa-create can store the bot token in Vault ([b393242](https://code.stanford.edu/iac/cloud-framework/-/commit/b393242f565e28a270f0c99d17acac39843b30e6))

- feat(renovate): cross-group service-account bot (sa-create + add-groups) ([7883a91](https://code.stanford.edu/iac/cloud-framework/-/commit/7883a91f6340e04cd5756c19a168c46640b8bf6e))

- feat(renovate): optional dedicated bot identity (create/list/revoke/ci-set) ([87d8a2c](https://code.stanford.edu/iac/cloud-framework/-/commit/87d8a2c7cff1fb3ae87812088764ba2ed08313d8))

- feat(renovate): renovate-admin-update — build admin repo list from repos.txt ([1dea920](https://code.stanford.edu/iac/cloud-framework/-/commit/1dea92020babf4f36ea67c802fb0509ca83019a5))

- feat(renovate): root-controlled admin scans via RENOVATE_ADMIN_CONFIG ([c362da5](https://code.stanford.edu/iac/cloud-framework/-/commit/c362da58e3a471145e0954814536c7290b21a2f8))

- renovate: add dependency-update module, scripts, CI template, docs ([a8de269](https://code.stanford.edu/iac/cloud-framework/-/commit/a8de269924077b07c31cc8b41b2297fc0e041cad))

- Factor iap-authz into gke-iap-authz.sh with IAP_MEMBERS validation ([9347bc5](https://code.stanford.edu/iac/cloud-framework/-/commit/9347bc59510c6d238653cd866604c989fd69b6d7))

#### Changed

- docs(renovate): document Terraform-provisioned bot via Vault token path ([1f372ca](https://code.stanford.edu/iac/cloud-framework/-/commit/1f372ca072770a7fa576f30bec554bbd2a1b7aca))

- refactor(renovate): route renovate-bot API calls through gitlab.sh helpers ([aff5ae4](https://code.stanford.edu/iac/cloud-framework/-/commit/aff5ae4f254165c3fcfdd382722d2703cff7264e))

- feat(renovate): default bot to Maintainer; RENOVATE_BOT_NAME for multiple bots ([32cce66](https://code.stanford.edu/iac/cloud-framework/-/commit/32cce66fdf6e5e6d72818a80c3a3441a8dff6e38))

- refactor(renovate): one RENOVATE_TOKEN_VAULT_PATH for both write and read ([21f751c](https://code.stanford.edu/iac/cloud-framework/-/commit/21f751c1fd4dd351c0aa2d9b75ee15978f546326))

#### Removed

- refactor(renovate): drop in-tree bot management; identity is provisioned out-of-band ([fc5e4dd](https://code.stanford.edu/iac/cloud-framework/-/commit/fc5e4dd6886c8d9fe53152cdfc366a926e2b093c))

#### Fixed

- fix(renovate): bot operator token honors RENOVATE_BOT_ADMIN_TOKEN over ambient ([2868d0d](https://code.stanford.edu/iac/cloud-framework/-/commit/2868d0d9369bc9847b37c26a9666248a551bd8f0))

- fix(renovate): normalize endpoint scheme; add RENOVATE_TOKEN_FILE for multi-server repos ([dd5353f](https://code.stanford.edu/iac/cloud-framework/-/commit/dd5353fa1e6fb2fd76ccd0a72fb821f35f376354))

- fix(renovate): derive endpoint from remote host; scrub internal RENOVATE_* env ([5248d48](https://code.stanford.edu/iac/cloud-framework/-/commit/5248d486364a1d0039e210f878d355a3986f71a8))

- fix(upgrade-check): put update-otica hint on one line ([ea8ee0b](https://code.stanford.edu/iac/cloud-framework/-/commit/ea8ee0b5bb8807b0493a0a6e654d9315c1f48a08))

- fix(upgrade-check): fold CHANGELOG link into the review line ([13ee993](https://code.stanford.edu/iac/cloud-framework/-/commit/13ee993ee9f9c980112d6cf66be863a8dc5698af))

- fix(update): land branch refs on the remote head ([e76e787](https://code.stanford.edu/iac/cloud-framework/-/commit/e76e787c98f5eee088e765c1903f417ea3c38117))

- fix(upgrade-check): link to CHANGELOG instead of release page ([47eb20c](https://code.stanford.edu/iac/cloud-framework/-/commit/47eb20c86b3d9f3e327da4cc458bc5e5b0e5feb7))

- fix(upgrade-check): hourly fetch throttle and release notes link ([f49119f](https://code.stanford.edu/iac/cloud-framework/-/commit/f49119f3099d89a8ae0c698d82eb2fd8bc2bb4e0))

## 1.2.1 (2026-06-16)

#### Added

1.2.1

1.3.0