chore(release): bump to 0.13.0

[szhygulin]

Release v0.13.0 — versions synced across package.json, server.json (top-level + packages[0]), and the embedded SERVER_VERSION constant in src/modules/incident-report/index.ts.

Tests: 2455 / 2455 passing locally; `npm run build` clean.

After this PR merges to `main`, fire the publish workflow by tagging the merge commit and creating a GitHub Release:

```sh
git fetch origin main
git tag v0.13.0 origin/main
git push origin v0.13.0
gh release create v0.13.0 --title "v0.13.0" --notes-file
```

The publish workflow (`.github/workflows/publish.yml`) is `on: release: types: [published]` — pushing the tag alone won't fire it; the GitHub Release event is the trigger.

Highlights

New tools

• `resolve_token` (Allow symbol+chain instead of contract address on prepare_token_send #440) — symbol+chain → canonical contract w/ bridged-variant warnings (USDC vs USDC.e on Arbitrum/Polygon/Optimism, USDC vs USDbC on Base).
• `list_solana_validators` (Add validator-ranking helper for prepare_native_stake_delegate #436) — stakewiz-backed ranking helper for `prepare_native_stake_delegate`. Surfaces wiz_score, commission, MEV-enabled, APY estimate, delinquent + superminority flags.
• `prepare_sunswap_swap` (Add SunSwap (TRON DEX) for same-chain TRX↔TRC20 swaps #432) — TRON-native DEX for same-chain TRX↔TRC20 swaps.
• EVM + Solana swap filters (Expose multi-route comparison + DEX pinning in swap quote tools #439, feat(swap): excludeExchanges/excludeBridges/order on EVM, dexes/excludeDexes on Solana #516) — `excludeExchanges`/`excludeBridges`/`order` (LiFi), `dexes`/`excludeDexes` (Jupiter).

Security hardening

• Invariant Add Base network support (chainId 8453) #14 ([security] Add Invariant #14 — durable-binding source-of-truth verification (selection-layer attacks) #460) — `durableBindings` field on every prepare_* tool that binds funds to a durable on-chain object selected from a multi-candidate set (validator vote pubkey, TRON SR, Compound Comet, Morpho marketId, MarginFi bank, Uniswap V3 LP tokenId, BTC multisig xpub, allowance spender). Skill consumes it as the assertion target.
• Invariant Release v0.2.0 #8 BIP-137 hardening ([security] Harden Inv #8 BIP-137 message-sign with byte-fingerprint + drainer-string refusal #454) — `messageSha256` byte-fingerprint in `sign_message_btc`/`ltc` responses + drainer-string refusal (`transfer` / `authorize` / `grant` / `custody` / `release` / `consent` markers, plus multi-word templates).
• `SignedContactEntry.intendedChains` ([security] Extend contact metadata with per-EVM-chain tag for CONTACT-CHAIN MISMATCH #482) — `CONTACT-CHAIN MISMATCH` warning when prepare's `chain` arg doesn't match the contact's intended chain set. Defense-in-depth for the script-133 Carol-on-Arbitrum-sent-on-Ethereum scenario.
• `UnsignedTx.secondLlmRequired` scaffold ([security] Add Invariant #12.5 — hard-trigger ops list requiring mandatory second-LLM #501) — flag for Inv Auto-discover Morpho Blue positions via event-log scan #12.5 hard-trigger ops.

Token-send

• tokenClass framework (Surface rebase / fee-on-transfer / blocklist flags in prepare_token_send #441) — non-standard transfer-semantics flags (rebasing seeded; blocklisted/FoT/pausable/upgradeable_admin deferred per Token-class registry: seed data for blocklisted / fee_on_transfer / pausable / upgradeable_admin (follow-up to #441) #508).
• `prepare_solana_native_send` memo (Allow optional memo on prepare_solana_native_send #434) — optional UTF-8 memo via SPL Memo program v2.
• `prepare_morpho_repay` accepts `amount: "max"` (prepare_morpho_repay should accept amount="max" for full repay #437) — shares-mode close, exact regardless of accrued interest between sign and broadcast.

Yields v2 (#431)

• DefiLlama bundle (compare_yields: Morpho Blue adapter (split per-market reader from getMorphoPositions) #287, compare_yields: Kamino adapter (split wallet-less reserve reader from getKaminoPositions) #289, compare_yields: Marinade APY reader (mSOL stake-pool yield) #290, compare_yields: Jito APY reader (jitoSOL stake-pool yield + MEV bonus) #291) — Marinade + Jito + Kamino-lend + Morpho-Blue curated vaults via one cached fetch.
• MarginFi on-chain wallet-less reader (compare_yields: MarginFi adapter (split wallet-less bank reader from getMarginfiPositions) #288) — DefiLlama doesn't carry MarginFi borrow-lend, so this one needed the on-chain bank reader.
• EigenLayer + native-stake deferred indefinitely (compare_yields: EigenLayer adapter design (operator/AVS-aware yield model) #292, compare_yields: Solana native-stake adapter design (validator-aware yield) #293) — LRT issuers + Marinade/Jito are the practical substitutes; per-operator/per-validator row shape was too expensive for the marginal user value.

PnL

• `get_pnl_summary` mtd period (Add MTD / custom-window period to get_pnl_summary #447) — calendar month-to-date.

Fixes

• `TRON_TOKENS.USDD` pointed at WTRX ([bug] TRON_TOKENS.USDD points to WTRX address, not USDD #507).
• Self-referencing glama badge breaking on glama.ai (fix(readme): drop self-referencing glama badge that breaks on glama.ai #521).

Roadmap defers

• BIP-322 message signing (Add BIP-322 BTC message signing alongside BIP-137 #438), `prepare_eip7702_authorization` ([tracking] prepare_eip7702_authorization — gated on Ledger Live + WalletConnect 7702 primitive support #481), Tier-1 bridge facet decoders ([security] Tier-1 facet decoder + Inv #6b for opaque cross-chain bridges #451), Solana NFT trio (Add Solana support to get_nft_history (Helius DAS getSignaturesForAsset) — follow-up to #433 #474/Add Solana support to get_nft_collection (Helius DAS getAsset / getAssetsByGroup) — follow-up to #433 #475/Add floor pricing to Solana NFT portfolio rows (Magic Eden / Tensor) — follow-up to #433 #476), BTC/LTC dryRun (BTC + LTC prepare_*_send: dryRun mode for inspect-without-pairing (followup to #446) #479), solo-validator deposit (Native ETH 32-validator deposit() builder for solo staking #430).

Deliberately deferred

• Token-class seed data for blocklisted/FoT/pausable/upgradeable_admin (Token-class registry: seed data for blocklisted / fee_on_transfer / pausable / upgradeable_admin (follow-up to #441) #508) — closed as won't-fix-until-concrete-case. Three classes have no live targets; `upgradeable_admin` needs a more targeted rule. Framework itself is shipped.
• Multi-route swap comparison endpoint ([swap] Multi-route comparison endpoint (get_swap_routes / get_solana_swap_routes) #517) — closed; `order: "CHEAPEST"` covers the dominant case.
• Skill-side coordination for Invariant Add Base network support (chainId 8453) #14 enforcement ([security] Add Invariant #14 — durable-binding source-of-truth verification (selection-layer attacks) #460) — companion work in `vaultpilot-security-skill`. The MCP-side `durableBindings` field is wire-ready; skill version bump + sentinel update lands separately.

Test plan

• `npm run build` clean
• `npx vitest run` — 2455/2455 pass
• `git grep "0.12.1"` — no stale references outside lockfile/fixtures
• CI green on this PR
• After merge: tag, GitHub Release, publish workflow runs through to npm + MCP Registry

🤖 Generated with Claude Code