v0.13.0

What's Changed

• feat(subagents): migrate definition format from TOML to YAML by @bug-ops in #1177
• fix(gateway): eliminate bearer token timing side-channel (SEC-M22-001) by @bug-ops in #1178
• feat(subagents): Phase 1 — TUI palette, Telegram fixes, secret bridge, E2E tests by @bug-ops in #1179
• feat(subagents): Phase 2 — permissionMode, disallowedTools, background auto-deny (#1145) by @bug-ops in #1187
• feat(subagents): follow-up fixes #1180-#1185 — spawn defaults, bypass gate, deny_unknown_fields by @bug-ops in #1188
• perf(llm): pad Block 1 system prompt to exceed 2048-token cache minimum by @bug-ops in #1189
• feat(subagents): TUI permission_mode badges, docs update, --init wizard (#1186) by @bug-ops in #1192
• fix(subagent): fail-closed security gate for non-Default permission_mode from user-level agents by @bug-ops in #1190
• feat(mcp): declarative per-server tool policy layer with rate limiting by @bug-ops in #1191
• feat(llm): Thompson Sampling router with Beta-distribution exploration by @bug-ops in #1193
• feat(memory): Ebbinghaus eviction policy with two-phase SQLite+Qdrant sweep by @bug-ops in #1194
• feat(subagents): Phase 3 — scope & priority system (#1145) by @bug-ops in #1210
• feat(subagents): integrate SubagentStart/SubagentStop hooks by @bug-ops in #1211
• docs(subagents): Phase 5 background lifecycle gap analysis and documentation by @bug-ops in #1213
• feat(skills): Agent-as-a-Judge feedback detector with adaptive threshold by @bug-ops in #1212
• feat(subagents): persistent memory scopes for sub-agents (#1152) by @bug-ops in #1214
• feat(memory): query-aware routing and active context compression (#1155) by @bug-ops in #1215
• feat(subagents): resume sub-agents by ID with persistent JSONL transcripts (#1153) by @bug-ops in #1216
• feat(subagents): /agents management UI with CLI and TUI CRUD by @bug-ops in #1218
• feat(llm): Thompson Sampling router with adaptive model selection (#1156) by @bug-ops in #1219
• release: v0.13.0 by @bug-ops in #1220

Full Changelog: v0.12.6...v0.13.0