chore: bump version to 1.13.2

[av1155]

Summary

Promotes the Unreleased block to 1.13.2. Changes only VERSION and CHANGELOG.md.

Closes #755

Changes

• VERSION: 1.13.1 to 1.13.2
• CHANGELOG.md: promote ## [Unreleased] to ## [1.13.2] - 2026-08-11, reseed an empty Unreleased block

Patch, since the only entry is a ### Security addition with no features or breaking changes.

Testing

Bullet claims pinned to source on main rather than taken from the PR title:

Claim	Evidence
carries a signed build provenance attestation	docker.yml:106-110, attest-build-provenance with subject-digest and push-to-registry: true
ships the matching .sigstore.json bundle	docker.yml:120,129, asset="houndarr-${TAG}.sigstore.json"
verifiable with gh attestation verify	checked against the command help

The other 19 commits since 1.13.1 carry no bullet. Only two touch the shipped app (#740, #752) and both change Dockerfile base image references without altering image contents or behaviour. dompurify and mermaid from the advisory-floor PRs are in website/package.json only, so those never reached the container.

Ran version-check.yml's assertions locally against the edited files, plus the release.yml tag-time awk extraction to confirm the release notes come out correct. All four quality gates pass: ruff check, ruff format, mypy (93 files), bandit (0 findings).

Type of Change

• Chore (chore:)

Checklist

• Issue exists and is linked above with Closes #N
• Linked issue has exactly one type:* and one priority:* label
• Linked issue has at most one phase:* label (or none when not roadmap work)
• Branch name matches issue scope
• Tests added/updated for all changes — N/A, version bump only
• Type check passes (mypy src/)
• Lint passes (ruff check .)
• Format passes (ruff format --check .)
• Documentation updated
• No secrets or sensitive data committed
• Scope check: release metadata only