v1.12.0 — Exact candidate search and named CI setup

Named review/security projects could be selected through the explicit API but could not obtain a compatible CI setup command. Extend the owner-scoped versioned seam with digest-pinned, task-specific review/scanner commands and failure-preserving Jenkins stages. Add exact canonical-model and evidence filters for Explorer transitions without changing ranking or catalog/runtime independence.

Historical pre-B7 configurations require a new revision. Pending profiles remain blocked; no runtime activation, migrations, agent consumer changes or deployment.

Validation: full fake PostgreSQL suite 1,166 passed / 40 opt-in skips; final selection/setup checks 40 passed after historical-config hardening. Shell syntax, Ruff F/E9, compilation and wheel build passed. The published security image passed the generated cgroup/read-only boundary offline with network disabled.

Release: backend 1.11.0 → 1.12.0 MINOR, additive compatible query parameters and setup support. Agents remain 1.7.0: no changed agent consumer requires an artifact. Publication is separate from deployment.

Published image verified anonymously: ghcr.io/steve-droid/driftplain-backend:1.12.0 at sha256:b819a57bf3854b0eaa5f8f2c42d81602c74b3776fd06d134ffbdb8538829da45. OCI revision/version match reviewed main. Release workflow 35973039404 succeeded.