v0.13.1

Mention failures during workspace preparation or card loading now produce a visible error reply and a stop reaction, including queued follow-ups. Job timeouts also report failure using a separate bounded publication context. Previously, a failed preparation hook could leave a comment with only an eyes reaction and no reply. Diagnostics redact configured credentials.

Use kardbrd attachment download CARD_ID ATTACHMENT_ID --output PATH to save attachment bytes. The command resolves the authenticated download redirect, fetches the HTTPS object without forwarding board credentials, and publishes only a complete file without overwriting an existing destination. The existing attachment get command continues to return metadata; its help now says so.

Deployments with an egress proxy must allow their attachment storage hostname. For the hosted Kardbrd kbn bucket this is kbn.sfo3.digitaloceanspaces.com.