0.13.1

Fixed

• Five reusables were self-applied but still recorded as unverified. When
  codeql.yml, gitleaks.yml, dependency-review.yml, and scorecard.yml were
  added as self workflows calling their reusables through relative refs, the
  runtime-coverage ledger was never updated to match — so the repository was
  proving these workflows on every push while the ledger claimed no observed run
  existed. Promoted to runtime-proven against runs that executed the current
  bytes: public-codeql.yml, secret-scan.yml, public-scorecard-json.yml,
  zizmor-sarif.yml, public-dependency-review.yml. Runtime-proven entries go
  from one to six.

  Nothing was promoted on estate evidence, although consumer repositories did run
  several of these today: every such run executed an older pinned revision, and a
  proof is only valid for the bytes it exercised. That tension is structural — a
  dependency bump invalidates a proof — which is why sustainable coverage comes
  from self-calling fixtures rather than from opportunistically harvesting
  consumer runs.

Added

• New skill ci-consumer-adoption. The skill set covered authoring and
  operating the library but nothing about wiring a consumer repository onto
  it, which is where the two observed failure shapes live: a repository that
  looks configured but still bills, and a repository routed to hardware its jobs
  cannot use. Covers tier selection from entitlements rather than visibility
  alone, pinning to a released tag by full SHA, runner routing by visibility,
  the two managed scans no workflow file can reach, and proving the routing from
  a completed run's runner_name instead of a saved setting.

Changed

• ci-cost-performance gains the visibility-routing rule and its corollaries:
  self-hosting pays only where minutes are metered, moving public work onto own
  hardware buys a fork-PR execution path rather than a saving, platform-scheduled
  scans carry their own runner control, there is no spillover from a busy
  self-hosted label to a hosted runner, and an isolated self-hosted runner is
  unprivileged so system-path installs fail there.