v1.13.0
v1.13.0 — trust lives with the instruction it protects instruction_sources becomes agent.instruction.trust: everything about the instruction now sits under agent.instruction.*, including who may sign it. Not called 'sources' because file/dir/url/oci/mcp are the sources. Plus agent.instruction.unenforceable (warn | refuse | ignore) for a pin that cannot enforce anything, and the restart-only-inside-reloadable arrangement declared and checked.