feat(mcp): add web.allowedorigins-removed rule; document v1.3.0 CORS migration

CHANGELOG.md

@@ -6,6 +6,21 @@ This module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html
 
 ---
 
+## [1.3.0] — 2026-08-08
+
+Minor. Tracks the framework’s v1.3.0 removal of `web.Config.AllowedOrigins`.
+
+### Added
+
+- `validate_snippet` rule `web.allowedorigins-removed` flags any reference to the removed
+  `web.Config.AllowedOrigins` field (selector or struct-literal key), pointing callers to
+  `server.Config.CORSOrigins`.
+
+### Changed
+
+- Wire builtin docs cover the CORS single-source-of-truth and the v1.x → v1.3.0 migration.
+- envspec test fixture updated: CORS lives on `server.Config`, not the root `web.Config`.
+
 ## [1.2.0] — 2026-08-08
 
 Minor. Scaffold and wire docs track the framework’s v1.2.0 CORS change.