chore: release 0.13.1

[steipete]

Prepare spogo 0.13.1 with four accumulated user-visible fixes: private atomic cookie writes, profile path isolation, correct device-name/opaque-ID targeting, and validated seek positions/paginated ranks. Put the security and credential-protection changes first and retain contributor credit.

This patch release changes no runtime or OS floor. The unified signed release workflow will create the tag and publish the verified binaries after this preparation commit has green CI.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 22, 2026, 8:28 AM ET / 12:28 UTC.

ClawSweeper review

What this changes

Dates the 0.13.1 changelog, adds highlights, prioritizes credential protection, clarifies POSIX permissions, and preserves contributor credit.

Merge readiness

✅ Ready for maintainer review

The release preparation remains necessary: main still has an Unreleased section, and the latest published release is v0.13.0. No actionable defect was found.

Priority: P3
Reviewed head: 6b61b1edd81f89803c915392eeeb183a48a445eb

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, accurate release preparation with no actionable review findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: This collaborator-authored changelog preparation changes no production behavior or stored-data contract; runtime proof is not required for this diff.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This collaborator-authored changelog preparation changes no production behavior or stored-data contract; runtime proof is not required for this diff.
Evidence reviewed	6 items	Introduced change: The pinned introduction changes only CHANGELOG.md: four additions and five deletions, retaining all four existing fix entries. Main still needs release preparation: The pinned main changelog retains an Unreleased heading above the same four fixes. Release contract: The release guide explicitly requires a dated changelog preparation PR, followed by green CI and dispatch of the unified workflow; release publication is a subsequent step.
Findings	None	None.
Security	None	None.

How this fits together

Spogo’s release process takes a dated changelog section and publishes it alongside signed release binaries. This PR prepares that release text for the existing workflow.

flowchart LR
  A[Accumulated fixes] --> B[Dated changelog]
  B --> C[Release preparation merge]
  C --> D[Unified release workflow]
  D --> E[Published notes and binaries]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Use this dated changelog section in the existing unified release process.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR prepares release notes and introduces no runtime behavior.

Is this the best way to solve the issue?

Yes: updating the existing changelog follows the repository’s documented release preparation process without duplicating version configuration.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 24a4e2ba9543.

Labels

Label changes:

• add P3: This is a focused release-note preparation change with no runtime modifications.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This collaborator-authored changelog preparation changes no production behavior or stored-data contract; runtime proof is not required for this diff.

Label justifications:

• P3: This is a focused release-note preparation change with no runtime modifications.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This collaborator-authored changelog preparation changes no production behavior or stored-data contract; runtime proof is not required for this diff.

Evidence

What I checked:

• Introduced change: The pinned introduction changes only CHANGELOG.md: four additions and five deletions, retaining all four existing fix entries. (CHANGELOG.md:3, 6b61b1edd81f)
• Main still needs release preparation: The pinned main changelog retains an Unreleased heading above the same four fixes. (CHANGELOG.md:3, 24a4e2ba9543)
• Release contract: The release guide explicitly requires a dated changelog preparation PR, followed by green CI and dispatch of the unified workflow; release publication is a subsequent step. (docs/RELEASING.md:33, 6b61b1edd81f)
• Published release: GitHub reports v0.13.0 as the latest release, published 2026-09-14T01:27:11Z; this does not establish publication of 0.13.1.
• Release-area history: Release documentation and workflow history identify Peter Steinberger as a recurring contributor, including the unified pipeline migration and subsequent release-guide maintenance. Older blob retrieval prevented full blame inspection; no source-line introduction attribution is asserted. (docs/RELEASING.md, c9bedbd18a69)
• Credential wording matches source: The existing atomic writer creates a temporary file, applies mode 0600, writes and syncs it, then replaces the destination. The PR only clarifies the release note’s POSIX permission claim. (internal/atomicfile/write.go:10, 6b61b1edd81f)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.