fix(mcp): allowedorigins-removed message says v1.3.0, not v2.0.0

internal/index/builtins/README.md

@@ -208,7 +208,7 @@ Whichever tier you pick, CORS origins always come from the framework var
 
 > **CORS has one home: `server.Config.CORSOrigins`.** In framework `v1.x`, `web.Config`
 > carried an `AllowedOrigins` field. It was env-backed through `v1.1.x` and a code-only override
-> in `v1.2.0` — reading it after the env tag moved silently served *no* CORS. **`v2.0.0` removed the
+> in `v1.2.0` — reading it after the env tag moved silently served *no* CORS. **`v1.3.0` removed the
 > field entirely** so the mistake fails at compile time instead of at runtime. If you are migrating
 > code that read `web.Config.AllowedOrigins` or set it in a struct literal, switch to
 > `cfg.Server.CORSOrigins`:
@@ -218,7 +218,7 @@ Whichever tier you pick, CORS origins always come from the framework var
 > //   mw.CORS(cfg.Web.AllowedOrigins)
 > //   web.New(logger, web.Config{AllowedOrigins: origins})
 >
-> // v2.0.0 — the single source of truth:
+> // v1.3.0 — the single source of truth:
 > mw.CORS(cfg.Server.CORSOrigins)                               // server.New tier
 > web.New(logger, web.Config{Server: cfg.Server})              // web.New reads it automatically
 > ```

internal/rules/cors_rules.go

@@ -29,12 +29,12 @@ func init() {
 // checkAllowedOriginsRemoved flags any reference to the removed
 // web.Config.AllowedOrigins field — both a selector (cfg.Web.AllowedOrigins) and a
 // struct-literal key (web.Config{AllowedOrigins: ...}). It was env-backed through
-// v1.1.x, became a code-only override in v1.2.0, and was removed in v2.0.0. Code
-// that still reads it compiled but silently served no CORS in v1.2.0; in v2.0.0 it
+// v1.1.x, became a code-only override in v1.2.0, and was removed in v1.3.0. Code
+// that still reads it compiled but silently served no CORS in v1.2.0; in v1.3.0 it
 // no longer compiles. CORS now lives solely on server.Config.CORSOrigins.
 func checkAllowedOriginsRemoved(c *Context) []Finding {
 	const (
-		msg  = "web.Config.AllowedOrigins was removed in v2.0.0 — CORS lives on Server.CORSOrigins (env EINHERJAR_SERVER_CORS_ORIGINS)"
+		msg  = "web.Config.AllowedOrigins was removed in v1.3.0 — CORS lives on Server.CORSOrigins (env EINHERJAR_SERVER_CORS_ORIGINS)"
 		hint = "Read cfg.Server.CORSOrigins (or set it in code); web.New applies it automatically. Never reintroduce a field/var for CORS origins."
 	)
 	seen := map[int]bool{}