v0.13.2

Fixed a full scan being OOM-killed on small hosts, and cut what the
scan spends on CPU and on waiting.

• the Go runtime is capped at 32MiB, so scan -f no longer gets
  OOM-killed on a ~1 GB VPS
• every wg/awg tunnel now uses the batch-1 bind: same results, 11x
  less CPU on a full scan (304s -> 28s)
• phase 1 probes addresses in parallel - on a network where nothing
  answers, its worst case drops from ~22 minutes to 3m39s
• the host ping burst goes out at once: an endpoint that ignores ICMP
  costs one -timeout instead of three
• the handshake poll backs off from 2ms instead of ticking at a flat
  50ms, so a live endpoint is confirmed in ~7ms instead of ~51ms

Commits

• perf: back off the handshake poll instead of a flat 50ms tick (a346aa5)
• perf: resolve the meta address without a global lock (6557ecf)
• perf: send the host ping burst at once and match replies by sequence (b414d42)
• perf: probe phase 1 addresses in parallel instead of one at a time (9e1c446)
• perf: give every wg tunnel the batch-1 bind, not conn.NewDefaultBind (58c7551)
• fix: cap the Go runtime at 32MiB so a full scan is not OOM-killed (6668e26)
• ci: lead the release notes with the annotated tag body (b71edc5)
• ci: leave docs commits out of the release notes (899590c)