chore[notask]: release sdk + bare-sdk 0.13.1 — finish bare-* cleanup (bare-fetch ^3.0.1, decoder-audio ^0.4.0)

[lauripiisang]

What this PR does

Releases @qvac/sdk + @qvac/bare-sdk 0.13.1 (lockstep) — a dependency-maintenance patch on top of 0.13.0 that finishes the bare-* cleanup, removing the deprecated @qvac/response and the exact bare-events 2.4.2 pin from the SDK dependency tree.

Changes

• bare-fetch ^2.9.1 → ^3.0.1 (sdk + bare-sdk). Transitive-only major; public fetch API unchanged. The only 3.x behavior change is 3.0.1 header validation, and all SDK header construction is RFC-valid. (The bare-tls trust-store change already shipped at 2.x via the lockfile.)
• @qvac/decoder-audio ^0.3.7 → ^0.4.0 (sdk + bare-sdk). 0.4.0 drops the deprecated @qvac/response (consolidated into @qvac/infer-base).
• Code change: decoder-audio@0.4.0 returns its QvacResponse from run() synchronously (it was a Promise in 0.3.x), so server/utils/audio/decoder.ts no longer awaits decoder.run().
• dev bare-subprocess ^5.2.3 → ^6.1.0 (sdk; not shipped to consumers).

Validation (clean install of this tree)

• No @qvac/response, no bare-events@2.4.2, no bare-fetch@2.x, no @qvac/decoder-audio@0.3.x resolve. bare-events resolves 2.9.1 (via @qvac/infer-base@0.4.2), bare-fetch 3.0.1.
• bare-subprocess@5.x remains only via bare-runtime + brittle (unavoidable; not an addon).
• bun run build (eslint + tsc) ✅, test:unit 10/10 ✅, desktop e2e transcription (decoder-audio path) ✅.
• check:deps-vs-sdk green (sdk ↔ bare-sdk lockstep at 0.13.1).

Skipped bare-* bumps

All other bare-* are same-major carets that resolve to latest at install (bare-fs 4.7.2, bare-os 3.9.1, bare-crypto 1.15.3, bare-stream 2.13.3, bare-pack 2.1.3, bare-process 4.4.1, bare-zlib 1.4.0, bare-abort-controller, bare-rpc, bare-runtime, bare-readline(dev), bare-url(dev)); bare-net 2.3.2/bare-path 3.0.1 already latest; bare-link >=3.0.0 peer covers 3.2.2.

Sequencing: this must publish after 0.13.0. Do not apply the publish label until @qvac/sdk@0.13.0 is on npm.

[github-actions]

Tier-based Approval Status

**PR Tier:** TIER1

**Current Status:** ✅ APPROVED

**Requirements:**
- 1 Team Member approval ✅ (1/1)
- 1 Team Lead OR Management approval ✅ (1/1)



---
*This comment is automatically updated when reviews change.*