ci(release): stop an empty source_ref falling back to the caller's br…

…anch (#134)

GitHub's && / || returns the value, so `inputs.owner && inputs.source_ref
|| github.ref` yields github.ref whenever source_ref is empty. The
checkout then asked the target repository for the caller's own branch:

    fatal: couldn't find remote ref refs/heads/ci/publish-dry-run

It failed loudly only because that branch does not exist on the target.
Had a branch of the same name existed there, the release would have
quietly built it -- the same class of fault this input was added to
prevent.

Defaulting to main keeps the value truthy, so a caller that names
nothing releases the target's main and a caller that names a ref gets
that ref.

chore(release): sync 1.1.3 across __init__ and package manifests (#127)

The 1.1.3 security release bumped pyproject.toml but left src/onot/__init__.py,
frontend/package.json, and electron/package.json at 1.1.2, so onot.__version__
and the desktop app version would ship as 1.1.2. Align all four to 1.1.3.

onot 1.1.2

QA report fixes (O-1..O-12): parse robustness, HTTP 500 crashes, notice injection
escaping, missing-license warnings, first-run UX, WCAG AA contrast, and Windows
desktop packaging hardening (windowsHide, sidecar log capture, Retry/Quit dialog).

onot 1.1.1

Fix the Windows packaged-app blank screen (#68) by emitting relative Vite
asset paths so the renderer loads over file://. Also clears High/Critical
SCA findings (electron, undici, form-data).

onot 1.1.0

update version 1.0.0

update README and version to 0.0.3

first commit