chore: prepare v1.3.8

[Wibias]

Summary

Prepare patch release 1.3.8 for the publication-integrity and watchdog reliability fixes merged in #403, #404, and #405.

Release delta

Base release: v1.3.7

Consumer-facing delta since that tag:

• Fix routed user intent handoff #403: routed create-PR intent now reaches the exact operation-bound mutation context automatically; caller-controlled intent remains non-authoritative, and Protection Off keeps zero Authority-host authorization.
• Bind pre-open evidence to publication #404: pre-open evidence is bound to the exact repository/base/head/diff candidate and enforced before initial push/PR publication, closing the wrong-scope fail-open path.
• Teach watchdog bounded dependency-following investigation progress #405: the watchdog recognizes a bounded deterministic dependency-following stable-source chain so legitimate investigation can reach a focused regression without weakening duplicate, volatile-polling, narration, or ordinary evidence-budget controls.

This is a backward-compatible correctness/reliability fix with no breaking change or new supported consumer capability, so the SemVer impact is PATCH: 1.3.7 -> 1.3.8.

Release preparation

• bump package.json to 1.3.8
• add the 1.3.8 changelog entry
• update README release note/current-state/watchdog text for 1.3.8

Scope

The branch changes only release metadata/documentation. The runtime fixes and regression coverage are already merged through #403, #404, and #405.

Tag creation, GitHub Release publication, release assets, npm publication, and merge are not part of this PR and remain separately authorized.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b14f5662-eddc-41e0-adc0-9c66b559bf04

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}