v0.1.2

Adds a public, atomic first-adoption bootstrap that seeds the current trusted executable as K's stable rollback target before the first service transaction. Exports K's canonical slot path resolver and pins the pnpm toolchain required by the OIDC publish workflow. Includes fail-closed partial-state checks and a real first-upgrade rollback tooth.