chore: take libid-profiles 0.13, where github reveals its token request whole

[SupremaLex]

Draft until libid-contracts publishes libid-profiles 0.13.0, which is where GitHub's token request becomes one revealed range with no committed suffix — the shape X already has. The profile table is generated there and reaches this crate through crates.io, so this branch lands in two steps.

In this branch now

• capture_ceremony defaults to one redirect URI for every platform, http://127.0.0.1:8722/auth/callback, the path the bridge serves, and listens on the matching address. One app registration per platform is enough to capture from, and the two values move together; --redirect-uri / --listen still override the pair. Independent of the profile change and green against 0.10.

Once 0.13.0 is on crates.io

• Pin libid-profiles and libid-identity to 0.13 (0.11/0.12 are content-identical to 0.10, so this is a pure pin bump like chore: take libid-profiles and libid-identity 0.10 #22).
• Layout::token_request(sent) -> Layout: no profile argument and infallible, since TokenSession has no secret_field after refactor(ceremony): the token request commits nothing, as a rule libID-contracts#45; LayoutError::MissingCredential and the committing-path tests go, nine call sites follow. the_github_exchange_is_revealed_whole, attest.rs and ceremony_end_to_end.rs assert zero sent commitments and the credential present in the revealed bytes. Already written, verified green against that branch's crate, and held for the pin commit.
• Closing check, no commit: cargo run -p libid-tlsn --example ceremony_fixtures against the published crate must reproduce byte for byte the github-ceremony-session.json the contracts PR carries.

Order across the repos

1. feat(ceremony)!: github reveals its token request whole libID-contracts#44 merges — the flip, prose, tests, both regenerated fixtures.
2. refactor(ceremony): the token request commits nothing, as a rule libID-contracts#45 merges — secret_field leaves TokenSession.
3. libid-contracts release/v0.13.0 merges and the release publishes the crate.
4. This PR takes the pin and leaves draft.