v3.12.1
Durable safety-default release.
- Ships the GitHub remote-owner identity guard and embeds its check for atomic first-use installation.
- Restores hard denial of ephemeral Task* state in favor of Kindex tasks.
- Requires same-session Kindex engagement before direct edits; missing distinct host session identity fails closed.
- Reconciles current compiled built-ins over stale machine policy snapshots while preserving distinct host rules and user overrides.
- Passes 218 tests, shellcheck, release build, and crate package verification.