Add public search indicators to default catalog and Sigma rules

VALIDATION.txt

@@ -243,3 +243,17 @@ The streaming recheck agreed with the standard engine on raw, Base64, URL-encode
 process-list and benign fixtures. Saved process/permission collection records
 were reviewed separately. Private rules, indicators, records and evidence remain
 outside the public repository. These results do not establish absence of compromise.
+
+PUBLIC INDICATOR UPDATE 1.0.3 - 2026-10-05
+
+Added seven IPv4 addresses and nine SHA-256 search candidates to the default
+catalog and Sigma selectors. Nine duplicate supplied indicators retain their
+existing metadata. New entries are reference_only with explicitly empty source
+lists; no malicious attribution is asserted. Total: 262 indicators, 57 rules.
+
+Validation: 152 tests passed with warnings treated as errors. Full catalog
+matching tests cover raw and decoded views and IP boundaries. Ruff check, Ruff
+format check and mypy passed. Wheel and source distribution built successfully;
+the wheel contains all 262 indicators. Added lines were checked for customer
+identifiers, local user paths and common secret markers. No case evidence or
+private files were included. Existing source records remain unchanged.