chore(main): release 0.13.0-rc.3

[github-actions]

🤖 I have created a release beep boop

0.13.0-rc.3 (2026-05-12)

Added

• admin: surface Ollama model-loaded state on /api/v1/admin/llm/activity (ce56f54)
• auth: thread password_min_length to CLI + web consumers (CA-321) (fa3fd2a)
• helm: render writable emptyDirs when readOnlyRootFilesystem=true (CA-322) (6e74da2)
• security: phase 7 — LLM base URL SSRF guard + password min-length configurable + surrealLLMConfig DTO (CA-320) (0672ba8)
• web,security: phase 6 — Next.js CSP + PostHog PII removal + MCP probe gate (CA-320) (996069c)
• web: alias ?tab=field-guide and ?tab=cliff-notes to knowledge tab (CA-252) (a4b9e10)
• web: phase 3 — UX + a11y polish (useAsyncOp, skeleton, tooltips, forms, sidebar, topbar, openCategory) (CA-320) (cd72648)
• web: render Ollama model-swap warning on admin monitor page (aa35a9b)
• web: ruby audit Low batch — a11y + UX polish (CA-271..278, CA-269, CA-273) (8cc3554)
• web: sticky Simple/Advanced mode toggle on long-scroll (CA-264) (3a9d049)

Fixed

• code-health: phase 2 — coerce helpers, joinComma deletion, UNCAPPED_SENTINEL, StoreRequirements error-return, sentinel errors, resolver dedup (CA-320) (ab19334)
• graphql: scrub low-level storage errors before they reach the browser (b51c5f1)
• infra: reconcile Phase 5 — Helm networkPolicy template (CA-320) (4cf332b)
• qa: CA-324 — discussCode prompt structure + null usage + silent empty answers (5ba768c)
• qa: CA-324 Fix B follow-up — AskModelResolver + synthesis_failed path (5d5f685)
• qa: CA-325 — make discussion-class RPC timeout operator-configurable (4736b83)
• qa: CA-326 — pin QA synth to MaxAttempts=1 + log provider-overload hint (f40ccbd)
• security,infra: reconcile codex r2 — worker SSRF wiring, sanitization, Helm memory default, PostHog tenant_id, CSP test, README (CA-320) (eb1df44)
• security: phase 1 — HSTS + token validation + JSON error sanitization + OIDC scrub + CORS guard (CA-320) (0d5f6ab)
• security: phase 1 follow-ups — trimmedName stored, HSTS docs, config.toml.example, CORS error message (CA-320) (a58336f)
• web: admin monitor mode-card uses control-radius token (CA-269 amend) (802febe)
• workers: CA-181 result_holder IndexError — append, not index-assign (d79344c)

Changed

• db: extract sqlbuild.Builder for 4 SET-clause sites (CA-306) (fdad166)
• dexter audit Low batch — fragment, stdlib, enum logging, dead alias (CA-195, CA-196, CA-197, CA-199, CA-310) (625bf31)

Documentation

• CHANGELOG + CLAUDE.md for audit Medium cleanup campaign (CA-320) (939e9e4)
• CHANGELOG + CLAUDE.md for CA-324/325/326 + gqlgen scrubber (f5b4be4)
• tests: document nil-store scope on phase1 setupTestServer (CA-288) (fb3577a)

---

This PR was generated with Release Please. See documentation.