Faryo 1.12.0

Faryo 1.12.0

Faryo 1.12.0 isolates every structured Web session behind its own supervised
official Codex App Server worker.

• The fixed faryo-appserver.service is now a read-only control plane for
  account, model, history and lifecycle requests. It never starts or resumes a
  Faryo Web thread.
• Each structured session receives an opaque, validated
  faryo-appserver-worker@.service instance and private Unix socket. Turn,
  command, Goal, approval and user-input RPCs route only to that worker.
• Worker clients have independent pending requests, generations, health probes,
  bounded reconnect backoff and circuit breakers. Late events from an old
  generation are ignored.
• A control-plane reconnect no longer reconnects healthy workers. Owner reload
  immediately returns a Loading projection while workers rehydrate, so the
  browser does not fall through to session unknown.
• A timed-out Stop first uses the official interrupt RPC, then recycles only the
  affected worker. Closing a session stops that worker and releases the Codex
  writer immediately.
• Diagnostics expose only worker/RPC category counts and terminal states. They
  contain no message body, title, path, thread identifier, socket, PID or token.
• Upgrade and rollback between the v1.11 shared topology and v1.12 isolated
  topology are idle-only, atomic and health-gated. Failure restores registry
  schema, exact unit files and previous services without touching tmux.

Fault injection proves that a permanently blocked or crashed worker cannot
delay a healthy peer. Real Codex acceptance additionally verifies one thread per
worker, a read-only control process, fast competing-writer failure, stable peer
PID/generation during recovery, an ordinary independent Codex CLI session, and
active-turn convergence across Owner restart.

The installed lifecycle was exercised in both directions: v1.11.11 to v1.12.0,
v1.12.0 back to v1.11.11, and forward to v1.12.0 again. Registry schemas,
services and browser reloads converged at each step while existing tmux pane
identity and geometry remained unchanged.

The release remains source-only and adds no Python, browser or CDN dependency.