release: prepare v2026.10.3

[github-actions]

v2026.10.3 — 2026-10-03

Fixed

• Vault snapshots no longer carry the local change journal, and snapshot redaction never re-journals what it clears (provenance: T13042)
• A v3 genesis checkpoint that covers segments must sit at or above their highest schema rise (provenance: T13048)
• The cloud vault names a Cleo Nexus server without key escrow instead of calling the vault empty (provenance: T13049)
• The first cloud push of a project works against Cleo Nexus (its key is minted as a rotation). It needs a Cleo Nexus server with cleo-nexus [Bug]: ct complete requires --notes but error message does not show the flag name #33, live in production, which lets a device of the account that registered a keyless project create the project's first key. Against an older server every first push is refused, and the error wrongly says the project key exists but was not shared with this account (provenance: T13098)