v5.1.3

Fixed

• Compiler detection uses cc/clang/gcc fallback chain when CC is unset or missing
• hatch_build.py uses the same fallback chain for wheel builds
• Narrow exception catches in _compile_jlinalg.py
• Assert C extension is loaded in CI

Added

• Sigstore build provenance attestations on PyPI publish
• OSV vulnerability scanning on pull requests
• YAML-form issue templates
• Streaming covariate integration tests

Changed

• Replace pre-commit with prek (Rust-based)
• Pin all GitHub Actions to commit SHAs
• Pin build-system.requires versions

Security

• Supply chain hardening: pinned actions, Sigstore attestations, osv-scanner
• Dependabot for GitHub Actions ecosystem