Helm v0.13.0 — operations-layer hardening

Helm v0.13.0

Helm v0.13.0 hardens the operations layer with patterns proven in live agent
operation: drift-tolerant config reconcile, a behavioral operating-contract
verifier, deterministic skill routing, a generic tool/MCP adapter layer,
grounding-by-guidance-injection, source-provenance tiering, fast-ACK request
intake, per-task interpreter fingerprinting, and non-file checkpoint backends.

Added

• helm reconcile: drift-tolerant, idempotent re-apply of workspace reference
  files against the packaged desired snapshot — classifies unchanged/missing/
  drifted/source_missing, adds missing files on --apply, preserves local
  overrides unless --force, and reports drift instead of clobbering.
• helm verify-contract: behavioral operating-invariant battery (command-guard
  deny/fail-closed, approval-gate TTL/consume-once, atomic ledger) complementing
  the structural doctor/validate checks — e.g. after a runtime bump.
• Deterministic skill router (scripts/skill_router.py): direct-routes when
  exactly one installed skill clears the confidence threshold, skipping
  model-based classification for unambiguous requests.
• Generic tool-adapter layer (scripts/tool_adapter.py): register external
  tools / MCP servers via a references/connectors.json data entry, with a
  built-in echo adapter, an MCP stub extension point, and a policy guard hook.
• Grounding-by-guidance-injection (scripts/grounding.py): assembles a skill's
  guidance and memory context into a model preamble, with a deterministic
  template fallback and a local-downgrade signal.
• Source-provenance tiering in the SourceBundle gate: refuses to promote a claim
  whose only readable corroboration is model_generated, ranking primary/raw >
  derived > model_generated (untiered evidence keeps prior behavior).
• Fast-ACK request intake (scripts/request_intake.py): dedups retried webhook/
  queue deliveries by delivery_id into a single pending task run.
• Per-task interpreter fingerprint + env-match, and run_checkpoint now uses
  sys.executable instead of a hardcoded python3 — fixing a silent pre-op
  checkpoint failure under a daemon whose PATH lacks the interpreter's directory.
• Non-file checkpoint backends (scripts/checkpoint_backends.py): capture the
  installed-distribution fingerprint (and diff it) before a runtime bump; a
  destructive command forces a pre-op checkpoint regardless of the profile flag.

Verification

• Full test suite: 1,596 passed (+73 over the 0.12.0 baseline of 1,523).