v0.1.2: store compatibility and bounded native environment

DSH STORE #1336 reported a missing compatibility declaration and file/command/environment capability signals.

This release adds the store-specific compatibility range, exact DSH release matrix and separately measured CLI install/start/uninstall evidence. Native Poppler/Tesseract subprocesses now receive only required runtime-path, font and OCR environment settings instead of inheriting host API keys and other credentials. File and command access remain explicitly documented.

Validation:

• 29 packed-plugin tests, including OCR, rendering, filesystem denial, cancellation and environment filtering.
• Actual disposable DSH 0.2.0-rc.2 profile: official CLI install, startup, five tools, PDF extraction, uninstall and clean restart.
• DSH STORE submission preflight passed for this fixed commit: complete 5/5-file scan, zero critical findings, one child-process review warning. Reports are attached.
• CI results.

This is source remediation and author verification, not store approval or an independent security audit. The store's stricter automatic admission policy still flags required file/command/environment access. Review evidence and limitations: Store #1336 record.

The release also includes the previously merged bounded PDF search and inspection-cache reuse improvements. Existing custom native wrappers that depend on arbitrary environment variables must set those values in the trusted wrapper itself.

Install the archive in the profile your DSH instance actually runs. Poppler and optional Tesseract language data remain external dependencies. No npm publication or change to the user's live profile is performed by this release.