Release TokenStep 0.2.13 with mandatory notarization gates

[Backtthefuture]

Summary

• bump the app and public documentation to 0.2.13
• make Apple notarization mandatory for every artifact written to release/
• require stapled tickets, syspolicy distribution checks, Team ID, version, signatures, and isolated updater acceptance
• upload as a draft, download and checksum-verify the assets, then publish only after all gates pass
• add a CI release-safety contract so the ordering and fail-closed behavior cannot silently regress

Validation

• 114/114 Swift tests passed
• collector, cumulative accounting, and recalibration fixture checks passed
• arm64 app build reports CFBundleShortVersionString 0.2.13
• public 0.2.11 DMG/ZIP passes the new artifact and updater gates
• public 0.2.12 DMG is rejected by both gates for its missing notarization ticket
• release scripts pass Bash syntax, version consistency, and fail-closed credential checks