docs(release): authored v1.13.0 release notes

Fettle v1.13.0: Evidence Integrity Hardening

Fettle v1.13.0 closes every finding from an adversarial audit of its own
evidence chain. The attacks are pinned by tests so they stay fixed: forged or
stale evidence can no longer turn a gate green, live agent runners lose their
blanket permission bypasses, and policy resolution now governs every consumer.

What Changed

• The assurance record's behavior dimension requires a passing verify stamp
  bound to the current session and HEAD revision; a red run is FAIL and a
  hand-written or stale stamp stays UNKNOWN. A red stamp also overrides a
  completed mutation report.
• The verify and CI Stop gates fail closed when a green stamp omits its
  canonical-evidence reference; deleting the key from the agent-writable stamp
  no longer skips the canonical validation layer.
• Assurance dimensions consume real, verifiable evidence: the CI dimension
  reads the stamp fettle ci wait actually writes and requires a green
  verdict bound to HEAD; authorization verifies capsule digest integrity;
  UAT requires the canonical sidecar to bind the exact report content,
  session, and completion.
• Live agent runners replace --dangerously-skip-permissions and --yolo
  with deny-by-default tool grants; a test invariant pins that no runner argv
  carries a permission-bypass flag.
• Profile command overrides and assurance release policies resolve through
  the layered policy resolver, so a repository-level override can no longer
  silently defeat org policy — and org packs can now supply release policies.
• UAT sessions, evaluator passes, and eval scenarios launch child agents
  under delegation capsules visible to fettle report --lineage; a
  provisioning failure downgrades to a traced ungoverned launch, never a
  silent one.
• The quality gate surfaces subprocess timeout, crash, and unparseable output
  as tool_error instead of a silent allow, restoring failure visibility and
  escalation.
• The host capability matrix declares per-event enforcement (block vs
  notify); fettle doctor discloses hosts where enforce-mode gates can only
  notify, and bridge fail-open toasts say so explicitly.
• Supply chain: the TLA+ verification workflow checksum-verifies
  tla2tools.jar and runs with least-privilege permissions; workflows and the
  published action pin actions by commit SHA and install analyzers at the
  pinned tool versions; workflow inputs reach shells only via environment
  indirection.
• LOW-severity sweep: the FETTLE_GATE_MODE=off kill switch is screened in
  every Bash command segment; mutation subprocesses no longer inherit
  credential-bearing environment variables; per-check budget overruns are
  traced; the agent-writable profile cache cannot override resolver-governed
  commands; published bridge directories are owner-only.
• Documentation now leads with pipx install "finefettle[all]" as the single
  installer covering analyzers, mutation, evaluation, commit hooks, and
  browser automation on top of the dependency-free core.

Deprecations and Accepted Risks

• The scripts → fettle/ compatibility symlink will be removed in the next
  minor release.
• Recorded accepted risks: runner prompts remain visible in process argv, and
  delegation environment export briefly mutates process environment on
  single-threaded launch paths.

Upgrade Notes

pipx upgrade finefettle
fettle doctor

Live UAT and eval runners now execute with scoped tool grants instead of
permission bypasses. If an agent run needs a tool outside the default grant,
the denial is visible in the transcript; no configuration migration is
required.