2.1.3: Upstream safety contracts and guarded delegation

Implemented concrete upstream behavior fixes and delegation safety.

1. Command and HTTP hooks honor onFailure:block. Exit2, continue:false, and structured denials block calls. The model can continue after a veto. MCP hook output replacement works.
2. Invalid matchers execute nothing. HTTP hook responses are capped at1MiB.
3. Read allow_large bypasses the default2000line limit, respecting explicit offset/limit and16MiB/100000line hard ceilings.
4. Edit,MultiEdit,NotebookEdit reject malformedUTF8 before modifying bytes. Unicode,BOM,CRLF,and trailingnewlines remain preserved.
5. Subagents inherit parent tool capabilities, permission checks, and hooks. Empty child tool lists grant no tools. Unsupported worktree requests are rejected.
6. maxTurns bounds model requests, including tool continuations. Children also have bounded delegation and backgroundconcurrency.

Validation:1008CLI tests and124script regressions passed, npm audit zero vulnerabilities. Packed artifact E2E covers upstream fixes and Anthropic/OpenAI tool roundtrips/failure exits. Live OpenRouter Read matches an exact fresh fixture. Skills/native Claude plugin installation, all3skill expansions using mock model transport, update and removal pass. Registry integrity and fresh installation evidence are attached.

PR: #30
Behavioral evidence: https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

npx @ruvnet/open-claude-code@2.1.3 --version

Native Claude plugin:

/plugin marketplace add ruvnet/open-claude-code
/plugin install occ@ruvnet-occ

Existing plugin users:

claude plugin update occ@ruvnet-occ

Full provider parity, prompt/agent hook evaluators, async hooks, complete persistence/checkpoint lifecycle and actual worktree isolation remain outstanding. Issue17 stays open. Capability proposals are advisory. See ADR006.

GitHub test workflow passed. Package verification workflow was queued at publication; equivalent required gates passed independently on ruOS.