chore(main): release 3.13.0

[github-actions]

🤖 I have created a release beep boop

3.13.0 (2026-10-08)

Features

• Add local flag overrides using dev server (#837) (6c1740f)
• sync: add prompt reference workspaces (#817) (040479a)
• sync: add scriptable prompt commands (#854) (771608c)
• sync: add searchable attachment API foundation (#839) (ef8ffb0)
• sync: add the prompt sync command (#814) (9c9183e)
• sync: attach tools and skills to variations (#841) (94512ad)
• sync: bootstrap prompt workspaces (#812) (c64ed62)
• sync: establish prompt sync foundations (#810) (568dff6)
• sync: link and detach prompt resources (#819) (dfd82b2)
• sync: orchestrate prompt synchronization (#820) (dfbfa1b)
• sync: persist local prompt workspaces (#811) (f0155d5)
• sync: persist manifests in LaunchDarkly (#852) (b16faca)
• sync: persist prompt sync manifests (#818) (d70eb9e)
• sync: reconcile prompt variation changes (#813) (f9365cf)
• sync: reconcile variation attachments (#840) (a112461)
• sync: render attachment-aware review output (#842) (c154f79)
• tell agents to write in Simple English, with hooks (#833) (c3e9c0f)

Bug Fixes

• Add local flag overrides using dev server (#837) (#850) (9197f92)
• dev-server: cap request bodies and retain at most 10k debug events (#846) (e381109)
• dev-server: listen on 127.0.0.1 by default (#845) (1854c86)
• sync: confirm destructive watch actions (#835) (6b2fb00)
• sync: guarantee prompt fingerprint convergence (#836) (be3865f)
• sync: safely clean unreferenced attachments (#843) (6b5be42)

---

This PR was generated with Release Please. See documentation.

---

Note

Overview
Release 3.13.0 — bumps the published version from 3.12.0 to 3.13.0 in package.json, .release-please-manifest.json, and the PACKAGE_VERSION example in PROVENANCE.md, and adds the 3.13.0 section to CHANGELOG.md.

The changelog entry documents what ships in this tag (already merged on main): a prompt sync surface (ldcli sync prompt workflows, local workspaces, manifests, variation/attachment reconciliation, scriptable commands, and review output), local flag overrides on the dev server, agent Simple English hooks, plus dev-server hardening (localhost bind, body limits, debug event cap) and sync safety fixes (destructive watch confirmation, fingerprint convergence, attachment cleanup).

^{Reviewed by Cursor Bugbot for commit 7134f26. Bugbot is set up for automated code reviews on this repo. Configure here.}

[davidbrackbill]

need to fix something in the local flags pr that got prematurely pushed