v0.12.0

• docs(changelog): roll v0.12.0 with a unified breaking section (#291) (06e862e)
• docs: record the policy denial error code as grandfathered (#290) (6ef2edf)
• fix(upstream): strip caller-supplied reserved headers in the sse forwarder (#289) (8b7dc6e)
• fix(transport): bound /sse concurrent session minting (#286) (b0a5a42)
• docs: position stateful governance after the stateless protocol pivot (#284) (f19a8ff)
• fix(policy): stamp resultType on the synthesized dry-run result (#283) (707490b)
• fix(transport): omit id from ingress rejection error bodies (#281) (08a95e3)
• fix(deps): lift nanoid past the custom-generator loop advisory (#279) (0056095)
• feat(transport): validate inbound header/body agreement per MCP 2026-07-28 (#277) (0a93cf9)
• feat(upstream): negotiate the MCP protocol version for relayed traffic (#272) (b03a63e)
• fix(upstream): relay the standard request headers on upstream forwards (#268) (22e517a)
• fix(deps): bump the MCP SDK so node-server dedupes onto 2.x (#262) (47aaf41)
• fix(deps): clear the advisory wave red-lining the audit gate (#261) (6ffd4c1)
• feat(upstream)!: detect the MCP era and revalidate tool definitions proactively (#255) (992003c)
• feat(policy)!: make session identity proxy-owned (#253) (47f01f5)
• docs(packages): sync package READMEs and refresh dashboard screenshots (#246) (572f014)
• chore(runtime)!: move the toolchain and supported runtime to Node 24 (#243) (59ae6be)
• fix(deps): clear the high advisories blocking the audit gate (#242) (db02b88)
• fix(transport): validate the Origin header on the MCP transports (#239) (5fdb435)