v0.13.0

Implements the two WS-liveness behaviors `PROTOCOL.md` documented as **MUST** but the daemon never did — so a non-responsive WS server can no longer wedge a live call. Closes the bulk of the protocol doc↔impl drift (bug #4).

## Added — WS liveness
- **Keepalive (§5.6)** — SiphonAI pings every `[bridge].ws_ping_interval_secs` (default 15 s); no Pong within `ws_pong_timeout_secs` (default 10 s) of an outstanding ping → the connection is half-open and the session drops (`error{internal,"ws keepalive timeout"}`, best-effort). Reconnect-eligible when `ws_reconnect_enabled` (0.7.3); else teardown. Previously only a *total* TCP disconnect was detected — a hung server on a live socket was invisible until the 60 s RTP watchdog.
- **Start-deadline / `server_too_slow` (§3.1)** — the server must send its first audio frame (or `hangup`) within `[bridge].server_start_deadline_secs` (default 5 s) of `start`, else `error{server_too_slow}` + `stop` and a definitive teardown (not reconnect-eligible). Raise it for cold-start LLM/TTS bots; `0` disables.
- All three knobs default to the spec values; `0` disables each guard. Daemon-wide; applies to inbound, outbound, and reconnect/retrieve sessions alike.

## Changed / Docs
- **PROTOCOL.md** error-code corrections (#219): dropped `codec_unsupported` (codec selection is SIP-layer → `488 Not Acceptable Here` before any WS bridge opens) and corrected `audio_format` to size-only (raw PCM16 carries no rate/channel metadata).
- forge-media pin → `049a19983a95` (PR #76): `EventBus::publish` no longer logs a spurious `WARN` with no subscribers. Logging-only.

Minor bump: new config fields + new teardown behavior. Defaults honor the previously-documented MUSTs, so upgrading is safe. Protocol stays **v1**.

PRs: #219, #220, #221.