Update 1.3.0 distribution metadata

[martincalander]

Summary

• update the source Homebrew cask to published Mac Drag Scroll 1.3.0
• pin the exact published MacDragScroll.zip SHA-256
• advance the OpenSSF Signed-Releases five-release window to v1.0.6–v1.3.0

Published release evidence

• stable release: v1.3.0
• reviewed release commit: 53cb3ce6ab45ed2c3cfa0a718e3645ec90774cfa
• ZIP SHA-256: baf0c2e8324755bf7fed4bc2a31e145c5e67bd00cc83e6a581fe09dc7611c2af
• SHA matches GitHub asset digest, SHA256SUMS.txt, the independently downloaded ZIP, and the verified provenance subject
• each of the current five releases has both detached signature and provenance assets

Validation

• scripts/check-repository-quality.sh
• scripts/validate-homebrew-cask.sh
• scripts/check-release-readiness.sh 1.3.0
• git diff --check
• exact cask checksum comparison against the published manifest and local ZIP hash
• independent read-only release-integrity/OpenSSF review

[martincalander]

All release-integrity validation and required checks are green on the final SHA 4ae3bcb7190dfd76c0b213354c489c3c89f06bee, including Quality Gate, Gitleaks, CodeQL, and Swift SAST. Merge-commit auto-merge is armed and will preserve the single distribution-metadata commit once the two required approvals are present.

@uglykatsuki @freddell97 @cmdprog — please approve if the published checksum and five-release Scorecard window look good.