Release 0.13.0: harden gate execution, snapshots and hooks

[renezander030]

Phase prerequisites could restart the run budget, cached passes could omit gate inputs, and some installed hooks could skip or weaken blocking decisions. This release closes those paths and prepares @reneza/skillgate 0.13.0.

• Share one deadline across phase prerequisites and gates; bound command output, clean up completed Unix shell descendants, and keep installed evaluator timeouts below host timeouts.
• Reject invalid explicit baselines, unreadable historical trees, and unrelated histories.
• Re-evaluate gates with external inputs; bind local cached passes to ignored inputs, branch/index state, and symlink contents; reject malformed cache records and changing-workspace receipts.
• Run pre-commit gates on deletion-only commits and upgrade existing Skillgate hooks while preserving policy flags and hook stages.
• Emit explicit Claude Stop JSON decisions, including a blocking fallback when the runner fails.
• Serialize installers per project and replace configuration files atomically while preserving permissions and other hooks.
• Match historical paths with the same glob syntax as disk scans.
• Resolve historical file contents correctly in nested workspaces.
• Require regular, readable evidence and pattern input files.

Verification: 186 tests pass on Node 18, 20, and 22. Coverage passes the configured thresholds (93.15% lines, 81.31% branches, 97.55% functions). Build, repository gates, diff checks, changelog extraction, and the packed npm artifact smoke test pass.

Review notes: based on 7721ec247bc9c6d9e65a3b80fc129dca82296a3f, with no other open PRs at preparation time. Changes cover evaluator/Git plumbing, receipts, hook installers, regression tests, package metadata, and documentation. Agent command matching, dependency checking, cryptographic features, and CI/release workflows retain their existing implementation. The 0.12.0 changelog entry is retained; 0.13.0 includes hook-reinstallation and stricter-baseline/cache migration notes. No release tag or package publication is part of this PR.