v1.2.0 — Engineering Quality

• Repair the release trust chain and make GitHub Release publication safely rerunnable without moving published tags.
• Harden the GitHub Actions supply chain with immutable action SHAs, Dependabot updates, bounded execution, least-privilege release jobs, artifact round-trip verification, and signed build provenance.
• Make repository-check execution explicit about trust: discovery remains read-only, while execution requires --run --trust-repository.
• Replace prose-only eval fixtures with 14 executable miniature-repository scenarios, deterministic post-agent checks, hidden-rubric staging, machine-readable results, and strict evidence semantics.
• Add current Codex, ChatGPT, and Claude Code metadata/guidance plus native Codex and Claude Code eval adapters with credential, home-directory, and Skill-integrity isolation.
• Add repository governance: CODEOWNERS, structured Issue Forms, Code of Conduct, security disclosure routing, active branch/tag rulesets, required CI checks, Discussions, and squash-only merge policy.
• Rework the README around quick start, concrete before/after behavior, searchable use cases, and inspectable evidence; add a maintained distribution/discovery playbook.
• Add a guarded release/v<VERSION> automation path that can create the immutable release tag only from the exact current main commit and removes its trigger branch after successful publication.