chore: release 0.13.3

[astyfx]

Summary

Prepare the 0.13.3 patch release with the changes merged after v0.13.2 in PRs #275, #276, #278, #279, #280, and #281.

Changes

• Redesign the pending Ask User Question experience with accessible radio and checkbox controls, custom answers, explicit Continue and Decline actions, responsive spacing, and compact settled-state summaries.
• Bind vault secrets to tasks by environment-variable name and inject values only into agent shell processes, preserving Claude and Codex launch and thread-resume overrides while keeping plaintext out of runtime options, prompts, transcripts, diagnostics, and logs.
• Scope unattended automation approvals to each run, isolating provider, Stave Local MCP, and Lens access and revoking the run authorization when it ends.
• Prevent Lens resize sash borders from overlapping adjacent surfaces.
• Keep active turns alive when the selected model changes during a conversation.
• Add a Fetch and checkout origin/main action that fetches the remote default branch, guards dirty trees, detaches HEAD safely, and renders detached checkouts clearly across workspace surfaces.
• Bump the application version to 0.13.3 and refresh CHANGELOG.md with outcome-focused notes and PR references.

Verification

• bun run typecheck — passed.
• git diff --check — passed.
• Tests intentionally not rerun for this release update per request; PR feat(scm): add fetch-and-checkout for the remote default branch as detached HEAD #281 focused checks had already passed.

Generated by Codex.

[upwind-code-us]

Upwind Code Scan - ✅ Proceed with Deployment

0 newly introduced vulnerabilities · 0 resolved · 0 total in this PR vs main

View full analysis in Upwind Console

Scan completed in 14s

Scan history (4 scans)

Commit	Scanned at	New	Resolved	Net
4b0ec1a	2026-07-29 13:16 UTC	0	0	0
4b0ec1a	2026-07-29 13:16 UTC	—	—	—
913dff9	2026-07-30 02:25 UTC	0	0	0
7456dc6 <	2026-07-31 01:26 UTC	0	0	0

Last scanned: 7456dc6 · 2026-07-31 01:26 UTC

[heath-s]

Approved