release: v0.1.2 security archive and verified delivery

[kevinten10]

v0.1.2 security archive

• Align package, OpenAPI and reference Provider versions with v0.1.2; promote the already-merged data-minimization fixes into a new archive without changing old tags/assets.
• Update bilingual README, security policy, public-safety guidance, documentation index, release installation and changelog.
• Verify an exact supplied archive, safe paths/private package boundary, five diagram hashes and real installed SDK/HTTP Provider exception/failure redaction in addition to existing CLI/SSE/cleanup checks.
• Stabilize fixture readiness and Git setup budgets: preserve 500ms descendant cancellation, five-second scanner subprocess limits, Provider deadlines and coverage thresholds; assert the descendant is alive before cancellation, ensure owned cleanup, and cap Vitest workers at two.

Verification at e7843f4

Fresh 2026-10-14 local pnpm check, pnpm sanitize and explicit new identity range check pass. Both ordinary and coverage runs pass 202 tests across 11 files. Coverage: 90.66% statements, 86.14% branches, 93.59% functions, 93.03% lines. Package verification passes 76 entries, five asset hashes, clean install/types/example, actual CLI/SDK/SSE/cleanup and installed Provider redaction. Dependency audit reports no known vulnerabilities. Four candidate commit identities pass.

Earlier retries exposed short fixture startup/setup watchdogs under host contention; they were not counted as acceptance. Readiness preconditions and output/error assertions remain in place, with product deadlines unchanged. Required Node.js 22/24 CI must also pass before merge.

All probes use public-source contracts, Mock Providers and synthetic fixtures. No private source, accounts, secrets, production data or cloud resources are involved. Historical author metadata is a separate pending owner decision; no force push, historical tag move or broad identity-erasure claim is included.

After merge, create v0.1.2 once at the exact checked main SHA; test the actual release tarball and downloaded bytes, publish SHA256SUMS, and verify tag/assets/version. Existing v0.1.0/v0.1.1 remain unchanged.

Both required Node.js 22/24 CI checks passed at exact candidate e7843f4f136cff335e3815013783c23c4e70c4de. The merge binds this head and explicitly uses the approved public noreply author email.

[kevinten10]

Release closeout: v0.1.2 targets merged main 9228de5 (same tree as the tested candidate). Required Node.js 22/24 CI passed all 202 tests. Exact archive and downloaded archive both passed independent offline installation/types/example/SDK/CLI/SSE/shutdown/Provider-redaction checks, 76-entry inspection and five image hashes. Downloaded attachments match originals byte-for-byte; SHA256 751365ee8eee5c166a5baadc1e2faf5b553cf1e2c6654c123fb78b8ca689438b. Project and independent extracted-distribution scans had no findings. Existing older tags/assets and branch protections were preserved. Legacy commit identities remain a separate owner decision; this delivery does not erase Git history or certify isolation. No cloud deployment or npm publication.