v0.13.3 — doc-audit bug fixes + stricter spec loading

Bug fixes and stricter spec loading, from the July 2026 documentation audit. Several previously silent no-ops now either work correctly or fail loudly at spec load.

Fixed

• Five bugs from the doc audit (#137-#141). drop(query=/command=) no longer drops all traffic (an empty pattern used to match everything) — it now matches the SQL statement / Redis command; Kafka duplicate(topic=) actually re-sends the produce (the consumer sees the message twice, the producer still gets one ack); unknown errnos and unknown service() kwargs fail at spec load instead of being silently ignored; proxy events carry action/protocol, so assert_eventually(...action == "error") can fire.

Changed

• Stricter spec loading. deny() rejects errno names outside the supported table (widened with the documented ENOSYS/EDEADLK/ELOOP/EDQUOT/ENOLCK); service() and the proxy fault builtins (response/error/drop/delay/duplicate) reject unknown keyword arguments with migration hints. Specs relying on silently-ignored kwargs (cmd=, http=, tcp=, name=) must switch to the documented forms.
• subject= is now an accepted topic= alias for NATS proxy fault matchers.
• Trace schema: proxy_conn_close and proxy_stall events now include the protocol field.

Verification: full host suite + go test ./testops/... -race + go vet green; Lima sweep 21/21 PASS across the 6 integration spec suites. See CHANGELOG.md.