10.13.0 (2026-09-21) Features 0b3c699 #9994 token: support read-write-stage-only granular access tokens (#9994) (@github-actions[bot], @Tayvon, @Copilot) Bug Fixes ddbadfc #9947 provenance-file takes precedence over OIDC auto-generated provenance (#9947) (@github-actions[bot], @yunseo-kim) 64d4b4b #9937 config: avoid exporting persistent allow-scripts (#9937) (@github-actions[bot], @Fnine59)