v1.2.1

Console redesign. The public console now matches antoine.nutu.net: dark
theme, the card's own words, a replayable public scenario with the answer
computed in your browser, four checks that lead with job outcomes, a
fail-closed tamper demo, and working search suggestions. No runtime, sample,
or eval change.

README. The opening timeline now includes the Data Sync lane and plain
wording for the unpublished weekly report.

Hardening. The console pages carry a Content Security Policy (same-origin
scripts, styles, and data only), with the boot fallback moved out of inline
script. CI checkouts no longer persist credentials. The package is marked
private so it cannot be published to npm by accident. @types/node tracks
the supported Node 22 runtime, zod is 4.6.5 in both labs, and npm audit is
clean.