1.2.0 — Expanded Obligations & Challenge Hints

Adds comprehensive obligation handling to the core guard (MFA, step-up levels, consent/ToS, CAPTCHA, re-auth freshness, age-verification, and HTTP auth challenges), with strict fail-closed semantics and machine-readable challenge values. Also supports effect-targeted obligations (on: "permit" | "deny") so denials can surface appropriate challenges (e.g., http_basic). No breaking changes; see docs/obligations.md for policy examples and extension guidance.