v0.13.97: v0.13.97

@newsroom.writer: new article, "What the $2,000 bitcoin bounty actually proves". Checks the real timeline of the stealmybitcoin.com win (the target had no attackable PHP page for most of its "19.28 hours"; the real build time was about three hours), what the published method's own limits say about replicability, what kind of access it actually obtained, five vendors' own WAF/IDS coverage and the gap each names itself, and the public record on hardening without patching, including GrapheneOS's own test of three mitigations before it chose to take its forum offline instead. Three figures, a summary per section and a graph.