chore(release): prepare MCP 1.0.13

[escott-]

Bumps the workspace, npm package, MCP Registry metadata, and the boundary self-test to 1.0.13, and adds the 1.0.13 changelog covering the three commits on main since v1.0.12:

• 4914437 Codex hook JSON and cross-checkout ignore crashes
• 34e657e context() trims protected fields instead of dropping them under the wire budget
• ed4b01f session(action="resume_list"|"resume")

No dependency changes: Cargo.lock differs from 1.0.12 only in the seven workspace package versions. The session tool's input schema gains two actions and a resume_id parameter (the pinned schema hash was already updated in ed4b01f).

Verification

On ovh-desktop, against main ed4b01f plus this change:

• cargo fmt --all --check
• cargo clippy --locked --workspace --all-targets -- -D warnings
• cargo test --locked --workspace --all-targets: 2952 passed, 0 failed
• account_connection_smoke.py against the built binary: 9 tests
• cargo audit --deny warnings and cargo deny --locked check: clean

Locally, on a clean copy of the tracked files: public_boundary.py, release_contract.py resolve-version for v1.0.13, the release-contract, boundary, DCO, workflow, grounding and adoption script tests, and npm test (6/6).

The new resume routes (POST /api/v1/session/resume/list and /get) answer 401 without credentials, while made-up routes under the same prefix answer 404, so they are deployed. I could not call them authenticated.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}