v2.13.0

Security

• Downloaded dependencies require current-rule analysis unless a local report or matching-analyzer corpus verdict is available.
• Local and untracked rule changes now invalidate cached verdicts, including rules installed without Git metadata.
• Untrusted upload rejection bodies are truncated and flattened before logging.

Features

• Added experimental render command for saved reports, with terminal, tiny, and interpretation output.
• Added unstable daemon-support library interfaces for Postdoc integration.
• Updated Cleave to 3.0.0-beta.2.

Fixes

• update-rules now honors --model-dir.
• FreeBSD worker freeze and resume operations now report an error when the worker has exited.
• Removed server --extract-dir support.
• Disabled OpenBSD and NetBSD release builds pending compatible Rust toolchains.

Optimizations

• Cache versioning reuses Cleave’s memoized rule-content and analyzer-build fingerprint.
• Experimental wire-report inference avoids rendering and compact-report copies; shared analyses are summarized once.

Full Changelog: v2.12.1...v2.13.0