v0.13.2 — Fix production webhook delivery and initial prompt completion

Accept webhook requests without a User-Agent at the Cloudflare edge. Mint OpenCode-compatible initial message IDs so webhook-triggered turns complete once instead of replaying.

What's Changed

• chore(release): VERSION → 0.13.2 [skip ci] by @github-actions[bot] in #6660
• fix(turns): box-initiated turns get authority; busy roots are never read as terminal by @markokraemer in #6657
• learnings: three rules from the v0.13.1 release-gate campaign by @markokraemer in #6661
• fix(session): polish the session UX end to end by @markokraemer in #6663
• refactor: stop inferring chronology from OpenCode message ids by @markokraemer in #6665
• fix(turns): turn-begin relay must authenticate as the sandbox, not a PAT by @markokraemer in #6664
• fix(billing): resolve entitlement from the subscription, not the stored tier by @markokraemer in #6662
• perf(boot): shrink OpenCode config runtime by @Ino-Bagaric in #6656
• chore(billing): backfill the renewal credits zero-grant legacy tiers never gave by @markokraemer in #6666
• perf(boot): bake the generic scaffold checkout by @Ino-Bagaric in #6668
• fix(billing): teach the entitlement invariant what a renewal now grants by @markokraemer in #6671
• perf(boot): make starter Git bundles provider-portable by @Ino-Bagaric in #6672
• chore(billing): reconcile stripe_subscription_status drift before #6662 promotes by @markokraemer in #6669
• feat(runtime): converge every sandbox onto the API it talks to by @markokraemer in #6673
• fix(boot): invalidate stale scaffold images by @Ino-Bagaric in #6674
• fix(runtime-assets): hash the sandbox binaries at startup, not on the request by @markokraemer in #6676
• docs(boot): record scaffold benchmark by @Ino-Bagaric in #6678
• feat(secrets): gate egress-enforced delivery behind experimental secrets_egress flag; default to environment by @markokraemer in #6677
• fix(sdk): sub-agent panels stop throwing 'Invalid session id' + quieter landing hero by @markokraemer in #6680
• gateway: remove the AI-SDK-native transport — OpenAI-compat only (reliability) by @markokraemer in #6679
• fix(secrets): relay substitutes handles in Authorization/Cookie (egress works for Bearer auth) by @markokraemer in #6683
• Serve every sandbox preview on its own origin by @markokraemer in #6681
• fix(web): sub-agent row hierarchy — one rail per level, agent rows that open by @sutharjay1 in #6682
• enh(web): landing page hero scenes and marketing rebuild by @sutharjay1 in #6658
• feat(secrets): stream the relay — no body caps, SSE, truncation sentinel by @markokraemer in #6685
• fix(boot): the managed-skill overlay no longer counts as the user's changes by @markokraemer in #6684
• refactor(session): one source of truth for what a session changed + the tracked package.json by @markokraemer in #6687
• fix(session): a finished turn stays finished by @markokraemer in #6688
• perf(web): verify the session JWT in-process instead of calling GoTrue on every navigation by @markokraemer in #6690
• fix(session): a retry is not the end of a turn by @markokraemer in #6691
• fix(queue): the inbox owns the queue by @markokraemer in #6692
• perf(sandbox): reduce cold OpenCode startup latency by @Ino-Bagaric in #6694
• perf(snapshots): materialize Platinum templates before activation by @Ino-Bagaric in #6695
• Prepare active Platinum images before cold boots by @Ino-Bagaric in #6696
• fix(slack): an app_mention was answered by whichever project got the callback, not the bot that was mentioned by @kubet in #6689
• fix(sessions): list and lifecycle answer manager standing from one predicate by @kubet in #6697
• fix(api): an algorithm the local verifier cannot check is not a bad token by @markokraemer in #6698
• perf(sandbox): add guarded project-image cold boot by @Ino-Bagaric in #6700
• fix(api): fail closed on unsafe FAST activation by @Ino-Bagaric in #6703
• fix(api,selfhost): isolate audit writes + Caddy retry so a slow audit write can't 502 the gateway by @markokraemer in #6702
• revert(queue): put the queue back the way it was by @markokraemer in #6699
• fix(web): stop the session boot shell vanishing at handover by @sutharjay1 in #6701
• fix(edge): accept webhooks without User-Agent by @markokraemer in #6709
• fix(gateway): bound per-request memory so the LLM path can actually autoscale by @markokraemer in #6708
• fix(web): restore voice input and subordinate menu styling — main was red by @markokraemer in #6711
• docs(learnings): a 'tried and reverted' comment is a decision record by @markokraemer in #6704
• docs(gateway): state the in-flight budget's unit, and pin it with a test by @markokraemer in #6710
• fix(dev): stop OOM-killing the dev API — 1024 MiB was a quarter of every other environment by @markokraemer in #6705
• fix(gateway): size the in-flight budget from the container, not from a constant by @markokraemer in #6712
• docs(learnings): a limit larger than the thing it protects is not a limit by @markokraemer in #6713
• fix(triggers): stop initial prompt replay loops by @markokraemer in #6716

Full Changelog: v0.13.1...v0.13.2