v1.2.2 — verified pricing and resilient refresh

Restores verified bundled pricing and repairs the scheduled refresh failure from issue #51.

• Compatible fixes for MCP SDK, proxy-addr, fast-uri and ip-address advisories; production and full release audits report zero findings.
• Real provider retrieval/validation with source vintage, SHA-256 receipts and completed verification times; unchanged 21-day gate.
• One bounded recovery for a scheduled hosted-runner acquisition failure, with diagnostics and isolated least-privilege handoff.
• Preview/recovery probes, stronger branch-scoped health reporting, and a documented owner approval step for quarantined bot PR CI.
• Validate the current refresh workflow's paginated REST history and select by creation time. This repairs a stale hosted liveness query caught in deployment verification while preserving failures and unknown-error reporting.
• The cost-estimate Action now installs 1.2.2. This release also includes the previously unreleased parser, pricing, budget and portability fixes listed in CHANGELOG.md.

Pricing prices were reconfirmed unchanged. GCP's September 24 source vintage is preserved separately from the October 7 retrieval/verification; curated subdatasets remain explicitly outside automated certification.

Validated clean installs, lint/type checks/build/coverage, freshness, production and full audits, live API/drift checks, production refresh/CI handoff and the deployed recovery controller. Packed-package smoke tests cover CLI, MCP stdio, pricing, request validation and allow/block budget behavior.