chore(release): 0.0.13 for the #156 worker image contract

#156 changes src/run-agent.sh and src/load-contracts.sh, which are baked into
the worker image. Its run-agent.sh refuses to start unless the launcher sets
MOSAIC_SYSTEM_PROMPT_FILE, and no launcher before #156 does. Rebuilding the
shared 0.0.12 tag would break the live pinned copy and rollback targets, so the
new image gets its own tag. No code change.

BUILD-LOG.md

@@ -5830,3 +5830,5 @@ Before: agents can read the library; supporting-path and push-credential depende
 2026-10-29T00:29:45-05:00 | Vikunja-19 FIX-156 R3 review repair BEFORE | Independent review report 12437B/SHA256 70daa15fdddfc83654821c99149dc84210a9bd7078614b60ff8e630e4fcb8a77 read in full. Branch is clean at published ee151685e9e15511407904397d73e4d82c37c85b, original base/merge-base 09a847edaa25b609bac7728ff83f224708a29399. F1 source trace confirms only the session-fork file bind is selected from inside a worker-writable directory and remains daemon-resolution TOCTOU; task/mission already use host-owned current-run write-once snapshots. Focused baseline19/19. Controls will require no-follow bounded descriptor copying to same-run evidence, original/foreign source refusal, immutable bytes after original substitution, and probe unsafe-user refusals; no native/container/full gate, install, credential, API, commit/push/amend or review dispatch.
 
 2026-10-29T00:33:07-05:00 | Vikunja-19 FIX-156 R3 review repair AFTER/source-verified | F1 fixed without a new schema: newest session fork is opened O_NOFOLLOW/O_NONBLOCK, fstat regular/current-uid checked, capped at 16777216 bytes before allocation, copied from that descriptor only after stable size/mtime/ctime checks, and published `wx` as current `runs/<id>/session-fork.jsonl`; `workerLaunch` accepts only that exact same-run snapshot and refuses shared-session/foreign-run sources. Real fixture substitution after snapshot cannot change mounted bytes; newest symlink copies/mounts no target; oversize refuses before publication/Docker. F2 documented honest unselected-tree boundary and retained selected managed-business/discord namespace collision; parent follow-up must choose dedicated legacy prefix or explicit collision refusals/migration. F3 probe symlink/nonfile/colon refusals documented and fixture-covered. F4 exact deferred #660 list now includes `scripts/test-darkwing-launch.mjs`; list not run. INFO dispositions: I1 stale comment and unused Docker-client MOSAIC_DATA_ROOT removed with 9pass/1RED then10/10; I2 raw basename comparison eliminated by same-run slot; I3 accepted RO control metadata unchanged; I4 worker-owned private prompt unchanged; I5 gated placeholders unchanged; I6 incomplete predispatch run pattern unchanged; I7 external-path Pi fork remains native #660 evidence; I8 pre-existing Claude adapter env gap unrelated/unchanged. Baseline19/19; principal RED18pass/5intendedfail after one fixture-only setup correction; F1 GREEN23/23; final23/23, four Node checks and diff check rc0. No full package, shell suite, Darkwing compatibility, build, Docker/Podman/bwrap/native/live/provider/network/credential/API/PR/review/commit/amend/push/merge/release action; #660/native/cross-family gates remain.
+
+2026-11-02T18:58:01Z | Q284 lead: FIX-156 release bump to 0.0.13 | The lead gate on lead/q284-land 418f00bce failed scripts/test-task.sh "mission and private prompt paths delivered to adapter" twice (94 pass, 1 fail). Cause: the local worker image mosaic-poc-agent:0.85.1-r0.0.12 was built 2026-10-21 from pre-#156 source; its baked src/run-agent.sh:39 exports MOSAIC_SYSTEM_PROMPT_FILE=/var/lib/mosaic/system-prompt.md over the launcher value. The test is right. #156 changes the image contract both ways: its run-agent.sh refuses when the launcher does not set MOSAIC_SYSTEM_PROMPT_FILE, which no pre-#156 launcher does, and its launcher with an old image drops the user context directory and the private prompt path. Rebuilding the shared 0.0.12 tag would break the live pinned copy and every rollback target, so RELEASE moves to 0.0.13 and the new image gets its own tag (compose builds it from source on first use; release.sh ensure aligns an instance). No code change. Live activation of 0.0.13 belongs to the next re-pin. |

RELEASE

@@ -1 +1 @@
-0.0.12
+0.0.13

docs/SESSIONS.md

@@ -1883,3 +1883,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-28 | Vikunja-19 | FIX-156 isolated legacy worker per-run mounts on work/vikunja-19-156-q284-worker-mounts at exact09a847e | Source/test/docs review-ready; focused18/18 plus prompt/syntax/diff checks green, no native/full gate or commit/push/PR/API; parent owns integration and CI.
 2026-10-28 | Vikunja-19 | FIX-156 atomic-control continuation on same uncommitted branch/base | Replaced inode-pinning processing file launch bind with narrow read-only control-directory view; source RED10/11 then GREEN19/19 plus syntax/diff checks, native/container CI still required and parent-owned.
 2026-10-29 | Vikunja-19 | FIX-156 R3 repair on published ee151685e without commit/amend | Replaced worker-writable session-fork bind with bounded no-follow current-run write-once snapshot; disposed F2-F4 and I1-I8, RED18/5 then focused23/23, #660/native/review gates remain parent-owned.
+2026-11-02 | Mosaic lead (Claude Opus 5.5, T3 c5c1e8ba) | PR 1835 (#156) RELEASE 0.0.12 to 0.0.13 so the changed worker image gets its own tag | Committed on work/vikunja-19-156-q284-worker-mounts; GPT review and lead gate follow.