caam v0.1.13

Fixes

SmartRunner honors UseGlobalEnv so vault runs keep the global environment (#64, 9f04ac8). caam exec/vault-backed runs no longer drop globally-configured env vars when the SmartRunner path is taken.
--effort passthrough on shallow-spawn (#63, 275a31d). caam shallow ... --effort <level> is translated to codex's model_reasoning_effort config.
Profile clone follows symlinked auth dirs and refreshes stale identity (#60, f8e42b1).
Installer fails closed on signature verification failure; cosign v2/v3 bundle compat (#59, 98335ba). eval "$(caam env ...)" fails loudly on error (#58, 3c2f2c9).
Daemon/discovery shutdown races closed; timing tests deflaked under load (736ec50, 4b7b986).
Claude plugin enablement preserved across account switches (#55, 6388856); user-installed skills shared into shallow profiles (#56, 201d9b4); caam config set is reflection-driven and can write every exposed key (#54, 98c05c7).

Grok Build (xAI's official grok CLI) is a supported provider (#57, 8716a85).

GitHub Actions is unavailable for this account (billing outage), so this release was built and signed locally instead of by the GoReleaser workflow:

Binaries built with CGO_ENABLED=0 go build -trimpath and the standard version ldflags, same five targets as v0.1.12.
SHA256SUMS is signed with the caam release key (cosign key-based bundle) rather than a GHA-OIDC keyless certificate. The public key is pinned in install.sh (and tracked as cosign.pub in the repo), and install.sh verifies keyless GHA certificates first, then falls back to the pinned key — still fail-closed.
Local gates: go build ./..., go vet ./..., full go test ./... (53 packages) all green. Any auto-fired failing tag workflow can be ignored.

Checksums in SHA256SUMS; signature bundle in SHA256SUMS.sig; build metadata in release-manifest.json.