chore(release): v0.21.1 - version bump, changelog, docs sync

[ajianaz]

What

Release prep for 0.21.1 (patch, approved by the owner): workspace version and internal deps, Cargo.lock, both READMEs, both skill copies, docs/core-contract.json (regenerated with docgen) and the CHANGELOG section.

Highlights of 0.21.1: uteke upgrade verifies a minisign signature (stable-only, no downgrade, fails closed), the Homebrew ORT_LIB_PATH directory bug is fixed, CLI logs go to stderr so --json stays parseable, rustls 0.23.46 (RUSTSEC-2026-0346..0349), a dependabot batch, and the release-signature reminder.

Why

The 0.21.0 Homebrew installs run without embeddings (#1459) and --json output is corrupted by log lines (#1461); both are fixed on develop, and #1327 stage 2 (signed checksums) is ready. 0.21.1 is the first release that can be signed with the offline minisign key.

Testing

• cargo run -p docgen: only version changes in core-contract.json.
• release_key_matches_pub_file and the skill version tests pass.
• Pre-release mutation gate: the standard gate selects 0 mutants for this diff (mutants.toml excludes embed/*.rs); a manual run over the changed ort_init.rs resolver with the exclusion lifted caught 1 of 1.
• Full CI runs on this PR.

[github-actions]

🔍 Cora AI Code Review

✅ No issues found. Code looks good!

---

Review powered by cora-code · BYOK · MIT