v0.9.13 — audit-log agent mutating actions (DIVE-1268)

Security

• Audit-log agent-* mutating actions (DIVE-1268). Non-root agent-* CLI callers (task done/answer, agent send) now land their mutating actions in the 640 root:claude tamper-evident audit log via a new hidden, append-only 5dive _audit_append NOPASSWD primitive — re-stamps .user from SUDO_USER (no actor spoofing), drops non-objects, append-only, never execs input. No perms loosened to a tamperable 660. Also fixes a Permission denied stderr leak. Diff-reviewed + on-box e2e verified (fresh standard-agent grant valid; re-stamp confirmed).