v0.1.3

release: bump version to 0.1.3

Ships the macOS release fix (signing can no longer block the build),
the MCP idle-timeout process-leak fix, the eval code-execution consent
gate, and SHA-256 checksum publishing/verification.

Urgent: skillrank.dev already serves the checksum-verifying install.sh
from main, and v0.1.2 published no .sha256 assets, so installs fail
closed until this release lands.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>