[atomantic]

Refresh Reactor SDK to 1.13.0 and the vocal separation runtime's SoundFile to 0.14.0. Regenerate both complete hash locks with uv 0.13.7 and the seven-day cutoff 2026-11-04T00:00:00Z. All other 53 Demucs identities and existing platform markers remain intact; adapters already read versions from the source/lock.

This is the first compatibility slice of #15769. docs/PYTHON_RUNTIME_REFRESH.md records the staged strategy and exact evidence. Lyric alignment, guard, remaining native profiles and individual major migrations remain open; uv bootstrap is owned by #15770, and unresolved Pixal3D CUDA stays under #15710.

Validation:

• Both profiles resolved online; the new pin hashes match the complete cooled PyPI artifact inventories. All seven Reactor wheels were downloaded and hash-verified.
• OSV/MAL querybatch: zero findings across all 55 distinct identities in the complete locks, including platform-marked entries.
• Fresh Apple Silicon scratch installations enforced hashes, no dependencies and wheels only; both passed uv pip check.
• Real Reactor 1.13.0 constructor and caller API smoke passed offline. Real Demucs provisioning/reuse and its exact interpreter/import/version/WAV probe passed; a CPU random-weight CLI run produced the expected finite stereo vocal WAV without downloading weights.
• Five focused installer/render/route regression files: 32 tests passed. npm run pregate passed against the identical committed tree, with treeStable: true.

Required local review: one gpt-6.1-terra high-effort round returned clean, inspecting all six changed files at 872ce385fee83641918192252940122cf6b3905e. Completion head is the same SHA.

Native Windows/Linux installations, live FastH3 provider streaming, Demucs Metal/CUDA and pretrained-model separation were not run. Resolution and fake subprocess tests do not certify those outcomes; remaining acceptance stays tracked in #15769.

Refs #15769