fix: pin browser-cli v1.1.13

[254808127]

Summary

• bump the npm candidate to 0.1.0-rc.3
• pin browser-cli v1.1.13 at commit 3af544780365309feae97d51b631070e7ca73762
• update Windows x64 and macOS arm64 asset names, native tests, and validation docs
• record the Windows static C runtime contract

Evidence

• COS SHA256SUMS matches both downloaded assets
• Windows SHA-256: 4ccadcc39e662b6d823ef7adc8bdfac00bde362c5e6b48b740b27b4ee1ed2a98
• Windows PE imports contain neither VCRUNTIME nor api-ms-win-crt
• macOS arm64 SHA-256: eeede33638bc314dee4c4f1a4ed725d91e1e48dfdd1af711f49dcaa18a4fcd3b

Validation

• npm run release:check
• 21 of 21 tests passed
• npm audit --omit=dev: 0 vulnerabilities

Real Windows and macOS native execution remains a manual platform gate after publishing the candidate.

[github-actions]

Claude finished @254808127's task in 1m 21s —— View job

---

PR Review

• Gather context and review PR diff
• Identify bugs and security issues
• Post findings

---

No bugs or security issues found. This is a clean version bump from v1.1.12 → v1.1.13. All references are updated consistently across native-source.json, src/binary.ts, package.json, package-lock.json, tests, and docs.

A few things I verified hold:

• Checksum validation is unchanged and correct (binary.ts:235–255): duplicate-entry detection in checksumForAsset prevents ambiguity attacks; the hash is verified against the COS-hosted SHA256SUMS manifest before the binary is installed.
• Fetch hardening is unchanged (binary.ts:454–458): redirect: "error" blocks redirect-based SSRF; URLs are HTTPS-only constants enforced by readNativeSource validation.
• No bypass introduced: the LEXMOUNT_BROWSER_CLI_PATH explicit-path shortcut (line 720–728) still runs verifyBrowserCliFile; no new skip paths added.
• All four PLATFORM_TARGETS asset names updated (lines 39–57), consistent with the version string change.

Nothing to flag.

[github-actions]

Automated Claude review completed. Review run: https://github.com/lexmount/dsh-browser/actions/runs/32124985671. Please check Claude's inline feedback and summary comment for details.

[github-actions]

Claude finished @254808127's task in 41s —— View job

---

PR Review

• Review diff for bugs and security issues

No bugs or security issues found.

The version bump from v1.1.12 → v1.1.13 is mechanically consistent across all 11 files: commit hash and version string match in native-source.json, binary.ts, and the CI pin check. All four PLATFORM_TARGETS asset names are updated. No security-relevant logic was touched.

[github-actions]

Automated Claude review completed. Review run: https://github.com/lexmount/dsh-browser/actions/runs/32126015223. Please check Claude's inline feedback and summary comment for details.