v0.13.0 — the third-state release

A third verdict, and no new detection.

Before this release, a run where no check group could execute returned PASS with exit 0 — so "checked and clean" and "nothing could be checked" were indistinguishable to the only surface CI reads.

• NOT-CHECKED (exit 2) fires when zero check groups executed. In practice that means fewer than five finite loss points and a non-positive mean loss — a short run whose loss is all zeros, the sub-threshold companion to TP-ZERO-LOSS. A short log with positive losses is not NOT-CHECKED: divergence and flat-loss are guarded by loss positivity rather than point count, so they run and the verdict is an honest PASS.
• Severity and exit code are now two separate axes. Severity orders FAIL > WARN > NOT-CHECKED > PASS. Exit is 1 for any FAIL, else 2 for anything unjudged, else 0.
• An unrecognised verdict normalises to NOT-CHECKED and exits 2. It previously ranked below PASS and matched neither exit branch, so a report trainproof could not classify was reported to CI as clean.
• All four renderers updated together — console, the doctor counts line, SARIF (mapped to warning, not note), and the HTML report.
• schema_version 2 → 3. The verdict enum gained a member, which is breaking for any consumer switching on verdict — hence a minor bump, not a patch.

166 → 179 tests. All 38 golden snapshots byte-identical and EVIDENCE_MATRIX.md differs only in its version stamp, so no existing verdict changed. Full details in CHANGELOG.md.