[crazyracer98]

Sync to template-base v1.13.0 (LIC1 GPL-3.0-only, DF12 CLAUDE_CONFIG_DIR, DF15a build job packages: write, SC1 zizmor/gitleaks/osv-scanner hooks and SHA-pinned Actions, SC3 owasp-scan generalised, B21 workflow inputs via env).

• replace tier: checks.yml, moderate-* and release.yml workflows, template-sync.yml, .github/scripts (new test_moderate_apply_result.py, discover-targets.sh for owasp-scan; removed find_moderation_result.sh, test_moderation_scripts.py and the two -apply workflows), owasp-scan skill, compose.yml, develop.sh
• merge tier: .pre-commit-config.yaml (new zizmor/gitleaks/osv-scanner hooks), new .gitleaks.toml, template-sync-manifest.yml, docs/TEMPLATE.md, READMEs, renovate.json; no conflicts
• repo-owned fix: codspeed.yml actions pinned to SHAs with version comments and persist-credentials: false (zizmor unpinned-uses / artipacked)
• .github/scripts/test_moderate_apply_result.py: reformatted by ruff format (base ships it unformatted for line-length 100, which fails the ruff-format hook); next sync will overwrite it, base should format it
• LICENSE already GPL-3.0-only here (chore: declare GPL-3.0-only (LIC1) #17), so no license change
• state set to v1.13.0

Release: patch (no feat from base lands in shipped package files).

Bumped to v1.14.1 (B22, template-base#57: ruff-formatted .github/scripts/test_moderate_apply_result.py; v1.14.0 is the same commit as v1.13.0).

[codspeed]

Merging this PR will not alter performance

✅ 1 untouched benchmark

---

_{Comparing template-sync/base-v1.13.0 (8fb62f4) with main (d1ffea7)}

[crazyracer98]

Superseded: the mid-template sync is handled separately (template-sync to v1.14.x).