v1.12.1

v1.12.1 — a document may not configure the terms it is judged by

Security: a served instruction document's :::!config could grant itself
capabilities (agent.document_capabilities), switch off the lethal-trifecta gate
(security.allow_trifecta), widen egress, change who the agent acts for
(identity.autonomous_as), or re-point its own source. The rule matched
top-level key names while the settings live nested, and fragments merge deep.
Now checked by path. Affected: through 1.12.0.