v3.12.0

• secure_this now returns a proofTest when it applies fixes: a runnable regression test that fails on the vulnerable code and passes on the fixed code (GuardVibe-as-oracle, an honest scan-based proof, not an exploit test)
• CLI shows it and --emit-proof writes it (default .guardvibe.test.ts); MCP returns it so agents can drop it into the suite as a CI regression guard
• No rule or tool changes (441 / 37); gate green (PASS/A/0)