chore(release): 0.13.0 — the milestone-26 batch

[cport1]

Rolls [Unreleased] to [0.13.0] and bumps all six workspaces plus the @webdecoy/node ranges in the adapters.

Minor, not major. Everything here is additive: protect() returns a richer object that still satisfies the old shape, allowed is unchanged including failing open on error, and every new rule and store is opt-in. Nothing behaves differently unless you configure it to — unlike 0.12.0, which moved where the client IP comes from.

@webdecoy/hono is a first publish, so the tag will create it on npm.

Contents — milestone 26, twelve of thirteen issues:

PR	What
#28	Typed decision (conclusion, per-rule results[], CHALLENGE, decision cache) + characteristics
#29	Pluggable rate-limit store + Upstash over HTTP
#30	botPolicy() (publish and enforce one policy) + attackSignatures()
#31	createFetchGuard() + @webdecoy/hono
#32	@webdecoy/node/testing, pluggable logger, llms.txt / AGENTS.md
#33	Client signals joined to the requests that follow
#34	Type-aware lint, and the four things it found (one real bug: async Express handler hung on throw)

Not in this release: #737 email validation (closed, not planned), #739 refactoring the three original adapters onto the shared guard, #740 OpenTelemetry spans.

Verified: 446 tests, 20/20 turbo tasks, check:edge green on all three edge entry points, no-explicit-any budgets 9/25/10/0/2/0.