v0.2.13

• Release v0.2.13
• Redact nonstandard bundle paths in diagnostics
• Avoid full paths in support logs
• Stop sync after unsafe correction path
• Cancel update checks on termination
• Pause runtime during model cache reset
• Reject symlinked correction imports
• Track correction sync content changes
• Fall back to direct text insertion
• Recover audio runtime after system wake
• Retry setup failures from checklist
• Document diagnostics workflow
• Strengthen release script self-test
• Expand diagnostics report
• Sanitize TCC reset environment
• Hash model files without following symlinks
• Open update logs before launching helper
• Sanitize updater process environment
• Create update helper scripts safely
• Reject hard-linked update logs
• Bound transcript correction entries
• Normalize stored hotkey choices
• Normalize stored app versions
• Normalize input device preferences
• Reject hard-linked log files
• Normalize correction sync file paths
• Normalize skipped update versions
• Reject correction writes through symlinks
• Bound stored correction decoding
• Bound update response decoding
• Harden update version parsing
• Harden application log writes
• Bound correction transfer file reads
• Harden update helper logging
• Avoid stale clipboard paste on insertion failure
• Reject symlinked model cache paths
• Guard speech model cache reset path
• Tighten update release URL checks
• Validate update release metadata
• Clean up update helper script files
• Harden model manifest updater
• Tighten model manifest validation
• Harden model loading and release checks
• docs: add llms.txt reference to structured metadata