docs: sync current release versions in governance

CHANGELOG.md

@@ -74,6 +74,8 @@ when releases begin.
   time-zone module, dual CLI archives, release evidence, and discovery topics.
 - Synchronized governance evidence with Tool Call Trace `v0.2.0` and its
   second published release.
+- Synchronized MCP Doctor `v0.1.13`, including its Node.js runtime diagnostic,
+  release assets, SBOM, provenance, and attestation evidence.
 - Made settings-audit gates control effective applicability, split Actions
   parent and selected fields into independent checks, and tightened ambiguous
   API and policy-schema decisions.

docs/RELEASE_POLICY.md

@@ -5,7 +5,7 @@
 | Setting | Current | Target | Apply when |
 | --- | --- | --- | --- |
 | Release automation | `cert_viewer`, `color_atlas`, `cron_maker`, `csv_sculptor`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `md_porter`, `pe_version_info`, `qr_forge`, and `tool_call_trace` have project-specific, tag-triggered publication workflows; `data_toolbox` currently builds candidates without an unattended publication job, and the organization reusable workflow remains read-only | Build and verify reproducibly, then publish from a protected tag with least privilege and project-owned verification | A project has stable hosted checks, immutable release inputs, a documented artifact contract, and explicit owner authorization |
-| Versioning | Published releases are `developer_primitives` and `tool_call_trace` at `v0.2.0`; `cert_viewer`, `json_yaml_swiss`, and `jwt_inspector` at `v0.1.1`; `csv_sculptor` and `pe_version_info` at `v0.1.0-alpha.2`; `color_atlas`, `curl_builder`, `data_toolbox`, and `md_porter` at `v0.1.0-alpha.1`; and `cron_maker`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `mcp_doctor`, and `qr_forge` at `v0.1.0` | Use Semantic Versioning for public versions and document pre-`1.0.0` instability | A project declares a public contract and its first release is authorized |
+| Versioning | Published releases are `developer_primitives` at `v0.2.0` and `tool_call_trace` at `v0.2.1`; `cert_viewer` at `v0.1.2`; `json_yaml_swiss` and `jwt_inspector` at `v0.1.1`; `csv_sculptor` at `v0.1.0-alpha.5`; `pe_version_info` at `v0.1.0-alpha.4`; `color_atlas`, `curl_builder`, `data_toolbox`, and `md_porter` at `v0.1.0-alpha.1`; `mcp_doctor` at `v0.1.13`; and `cron_maker`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `qr_forge`, and `recoverable_delete` at `v0.1.0` | Use Semantic Versioning for public versions and document pre-`1.0.0` instability | A project declares a public contract and its first release is authorized |
 | Changelog | This governance repository contains only an `Unreleased` section | Maintain Keep a Changelog categories and move entries to a dated version only during release | A reviewed release candidate is approved; do not create historical entries without release evidence |
 | Git tags | Every published release above has a `vMAJOR.MINOR.PATCH` tag; repository rules protect current release tags from deletion or mutation | Use protected, immutable `vMAJOR.MINOR.PATCH` tags that point to the reviewed release commit | Tag protection is verified, the release commit and version agree, and tag creation is explicitly authorized |
 | Artifacts | Release assets and verification material are project-specific; binary projects publish checksums, SBOMs, and attestations defined by their release contract | Publish platform artifacts with cryptographic checksums, an SBOM, and provenance appropriate to the build system | Artifact generation is reproducible, consumer verification instructions exist, and the release is approved |