🔖 Release 0.13.1

[taras]

Why

v0.13.0 published five binaries and no packages. Its release branch was
bumped before #831 added packages/git, so git reached the tag at 0.12.1;
publish-packages.yml read every manifest and refused, while release.yml read
packages/cli/deno.json alone and had already shipped the irreversible half.
#845 closed that gap. This cuts the release that carries the packages.

Not a re-tag of v0.13.0: its binaries are built, attested and downloadable,
and xmd upgrade can already resolve them.

The rolling draft is asking for exactly this — it carries release-drafter's
banner, "The manifests still declare 0.13.0, which is already released. Run
deno task bump 0.13.1 … and merge the bump before publishing this draft".
Merging clears the banner and sets the draft's tag and title to v0.13.1.

What changes

Before: manifests at 0.13.0, a version already tagged; @executablemd/cli at
0.11.0 on npm; @executablemd/git with only its 0.0.0-bootstrap.0
reservation and no JSR version at all.

After: every manifest, every bun.lock workspace entry and the site badge at
0.13.1, ready for the draft to be published.

Scope

Included

• deno task bump 0.13.1 across all eleven publishable members.
• The eleven bun.lock workspace versions, which the bump task deliberately
  does not touch (spec §2).
• site/routes/index.tsx's version badge.

Intentionally unchanged

• packages/test-support stays at 0.0.0 — private, outside the lockstep.
• Nothing in bun.lock outside the workspace entries. The lockfile is stale in
  other ways (a regeneration also wants semver, @types/semver, several
  missing dependency blocks, and @effectionx/node at the 0.2.5 the root
  package.json pins); that is a dependency change and belongs in its own PR.
• The npm propagation race (Build tagged npm packages without waiting for sibling registry propagation #843) is not fixed here.

How to verify it

• scripts/tests/version-lockstep.test.ts proves the bump is complete: it reads
  every publishable manifest and every lockfile entry, and holds this workspace in lockstep fails if any is left behind. Reverting bun.lock alone produces
  11 findings, which is the restamp this PR would otherwise have skipped.
• deno task gen:publish-workflow leaves no diff.

Run on this commit: the three release suites exit 0, deno task check exit 0,
deno task lint exit 0.

Generated or mechanical changes

• All 22 manifest edits are the version field only, written by deno task bump.
• The bun.lock edit is the eleven workspace version lines. No other
  occurrence of 0.13.0 exists in the file, so the replacement could not reach
  an unrelated dependency that happens to share the number (spec §2).

Risks and limitations

• cli may still fail its publish job. The dnt build resolves siblings from
  the public registry, and that race failed cli on both 0.12.0 and 0.12.1
  (Build tagged npm packages without waiting for sibling registry propagation #843). If it fails, re-run that one job once npm has indexed the siblings —
  publishing skips an already-published version, so the rerun completes only
  what is missing (spec §7).
• @executablemd/git's latest dist-tag currently points at
  0.0.0-bootstrap.0. This release is its first real version and moves
  latest onto it.

Scope confirmation

• Every changed file supports the purpose described above.
• Unrelated cleanup and formatting changes are excluded.
• Generated or mechanical changes are clearly identified.
• The description matches the final diff and test results.