fix: make reload coherent and guard the gateway (v0.13.2)

[nikita-rulenko]

Summary

• keep one process-owned ingest worker across SIGHUP generations
• publish coherent client/tooling/FastThink runtime generations while pinning existing FastThink sessions
• atomically claim ingest rows in HelixDB and preserve stale-row recovery
• add optional bearer authentication for the network gateway, disabled by default
• publish patch notes and upgrade guidance for v0.13.2 “The Guarded Reload”

Verification

• cargo fmt --all -- --check
• python3 .github/scripts/docs_lint.py
• cargo clippy --all-targets --no-deps -- -D clippy::too-many-arguments
• cargo test --lib --locked — 196 passed
• cargo test --lib --no-default-features --locked — 193 passed
• complete non-ignored cargo test --locked surface
• default and no-default all-target builds
• HelixDB CLI v2.3.5: 137 HQL queries compiled
• live atomic-claim and gateway bearer smoke

Upgrade note

Self-hosted deployments must back up the persistent HelixDB volume and redeploy the schema before replacing the binary because v0.13.2 adds claimPendingInput. Gateway authentication remains off unless a token is configured.

Closes #98
Closes #99