v0.13.5

One signed file, nothing fetched at install. Every dependency (viem, openpgp.js, noble, and the rest) is now bundled into dist/thurin.js, built from a lockfile with a hash for every package. Installing the CLI fetches nothing else, so the checksum named on-chain covers every line that runs. Installs shrink from ~96 MB to 2.5 MB. Bundled licenses ship in dist/THIRD-PARTY-LICENSES.txt.