release: v1.13.0 — CHANGELOG heading, components table, BASE_REBUILD_DATE

CHANGELOG.md

@@ -11,7 +11,41 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 ---
 
-## Unreleased
+## v1.13.0 — 2026-10-25
+
+Minor release. Headline: the **`pi-devbox-firstboot` skill** (first-boot
+acceptance scoped by published state) and two fixes our own repos carry: the
+**mailbox no longer lists long-answered asks as owed** against the 3.11.0
+central palace (mempalace-toolkit `c04d488`), and the **AWS SSO keeper stays
+idle when nothing in the session uses Bedrock** (pi-extensions `f032195`). Also
+`confirm-destructive` steps aside for another bash gate, a skill-frontmatter
+lint job, and the CI smoke-image reclaim fix.
+
+Surveyed 2026-10-25, each upstream queried directly. Unchanged since v1.12.2:
+pi `1.4.0` (npm `latest`), mempalace `3.11.0` (PyPI `latest`), pi-atelier
+`v0.16.0` (`3b42825`, newest tag), pi-observational-memory `022da5e`
+(= `master`), pi-fork `e69725c` (= `master`), pi-studio `v0.11.1` (`8a410b4`,
+= `main`, newest tag), pi-toolkit `7c05901`, Node `v24.22.1` (newest 24.x; Node
+26 is not LTS yet). The skillset snapshot needs no refresh
+(`vendor-mempalace-skill.sh --check`: OK, still `96b840e`). The base image is
+rebuilt, because `rootfs/` changed and the mempalace-toolkit SHA is part of the
+base hash, so apt and the base tools pinned to `latest` re-resolve. Of those,
+gosu, gitea-mcp and tealdeer moved upstream (table below). nvim `0.12.6`, fzf
+`0.74.5`, git-lfs `3.8.1`, gitleaks `8.30.1`, bat `0.26.1`, eza `0.23.5`, zoxide
+`0.10.0`, uv `0.13.5`, micro `2.0.15`, typst `0.15.1`, yq `4.54.1`,
+agent-browser `0.39.2` and playwright `1.64.1` match their newest releases.
+Each was compared against the v1.12.2 image on tor-ms22. The new download
+assets for both architectures exist (HTTP 200).
+
+### Components that move with this release
+
+| Component | Baked in v1.12.2 | v1.13.0 | Why |
+|---|---|---|---|
+| **mempalace-toolkit** | `d5a03f4` | **`c04d488`** | mailbox fix, see *Fixed* below |
+| **pi-extensions** | `4c1d28d` | **`f032195`** | `7237855` (bash gate, *Changed*) + `f032195` (aws-sso, *Fixed*) |
+| gosu (base) | `1.19` | **`1.20`** (or later: `latest` at build time) | Go security update (GO-2026-6686); upstream sees no realistic attack path in gosu |
+| gitea-mcp (base) | `v1.10.0` | **`v1.11.0`** (or later) | additive: `project_write` column options, `get_file_contents` `ref`/`path` optional; Go 1.27.3 security fixes |
+| tealdeer (base) | `1.9.0` | **`1.9.1`** (or later) | patch release |
 
 ### Added
 

Dockerfile.base

@@ -14,7 +14,7 @@
 # content-addressed over this file, so any byte change invalidates the
 # cache. Recommended cadence: once per release for security updates.
 #
-# BASE_REBUILD_DATE: 2026-10-22 (v1.12.2 — setup-lan-access.sh always Includes ~/.ssh/config; apt and base tools re-resolve (upstream on 2026-10-22: Node v24.22.1 and git-lfs 3.8.1 security releases, uv 0.13.5, agent-browser 0.39.2; gitea-mcp 1.10.0, nvim 0.12.6, fzf 0.74.5 unchanged); previous marker 2026-10-19 / v1.12.1)
+# BASE_REBUILD_DATE: 2026-10-25 (v1.13.0 — rootfs gains the pi-devbox-firstboot skill and mempalace-toolkit moves to c04d488; apt and base tools re-resolve (upstream on 2026-10-25: gosu 1.20, gitea-mcp 1.11.0, tealdeer 1.9.1; Node v24.22.1, git-lfs 3.8.1, uv 0.13.5 unchanged); previous marker 2026-10-22 / v1.12.2)
 #
 # ── Lineage note ─────────────────────────────────────────────────────
 # Adapted from opencode-devbox/Dockerfile.base (commit before v1.16.2).