chore(release): cover the last two commits in the 1.3.0 notes

[abrichr]

The 1.3.0 notes were written before the last two commits landed

#118 and #119 merged after the section was prepared, so neither appeared in it. #118 matters most: it adds a user-facing command and a network fetch, and release notes that omit that are misleading.

The FFmpeg entry, and why it is worded that way

#118 adds capture install-ffmpeg, which downloads a LGPL-2.1-or-later build. This repository must not ship copyleft material inside an MIT artifact, so I verified the boundary against the built artifacts rather than trusting the commit message:

$ unzip -l dist/openadapt_capture-1.3.0-py3-none-any.whl | grep -i ffmpeg
    24000  openadapt_capture/ffmpeg_runtime.py
$ tar tzf dist/openadapt_capture-1.3.0.tar.gz | grep -i ffmpeg
    openadapt_capture-1.3.0/openadapt_capture/ffmpeg_runtime.py

Only the downloader source, which is this project's own MIT code. No FFmpeg binaries, no native libraries, in either artifact. The wheel is 265K, consistent with pure Python.

The fetch is opt-in and pinned: 34 sha256 digests in ffmpeg_runtime.py, and nothing executes at import time. Both repository gates agree:

$ python3 scripts/verify_distribution.py dist/*
verified dist/openadapt_capture-1.3.0-py3-none-any.whl
verified dist/openadapt_capture-1.3.0.tar.gz
$ python3 scripts/check_source_boundary.py --require-dist
OK: source tree and distributions satisfy sha256:d626f2ad...

That is a pinned, hash-verified, opt-in upstream fetch, which is the shape the licensing policy asks for. The notes now state it so a reader does not have to re-derive it.

The version is unchanged

Still 1.3.0. Since v1.2.2 the highest implied bump is minor, #118 is another feat, and #119 is a fix. A feature does not push a minor further; only a breaking change would. Re-checked rather than assumed.

Verified

$ python3 scripts/check_changelog.py
verified CHANGELOG.md through v1.3.0

Documentation only. No code, no version, no lock change.