0.12.0 — secrets to .env.local, hang fixes, review wave

Highlights

• Secrets never land in settings.json: masked /config rows (web provider keys/cookies, a2a gateway tokens) now persist to <agentDir>/.env.local (0600). A startup migration moves any pre-fix plaintext secrets out of settings.json automatically. URLs/timeouts stay in settings.json.
• 8h herdr hang fixed: the systemone classify transport now carries a default 30s deadline and routing races it at 45s (both fail open) — a silent router endpoint can no longer park a dispatch forever. The herdr wall-clock cap is now the opt-in hard cap or 60 min (never the 3-min idle window that killed healthy long-running panes).

Review fixes (13 findings, two subagent review waves)

• repair: read guard no longer blocks numeric path-selector reads; successful edit refreshes the write-freshness baseline (read → edit → write works); selector reads arm the guard too
• rules: project RULES.md is trust-gated (untrusted checkouts never inject rules); created @import targets invalidate the cache
• router: /v1 classify URL convention (bare-host baseUrls silently 404'd every classify); repo overlay resolves from session cwd
• classifier: bash verdicts bounded to a 2.5s budget; 3-strike failure breaker (5-min cooldown)
• subagent: dispatch verdict gates on the chosen label's own probability; worktree removal locks on the repo root; schema text matches ceulen timeout semantics
• advisor: enable-only /config save no longer replays the whole transcript
• load order: rtk moved before steering (+ a registration-level guard test)

Tests: 2647 → 2661, all green.