v0.12.0 — 全域監査の確定修正＋agent_transcript 回収

Multi-agent adversarial audit (find → refute → live smoke) of v0.11.0, plus the fixes and one feature that survived it. Audit digest & rejection ledger: docs/11_audit-2026-07-11.md; transcript-read design: docs/12_agent-transcript-read-plan.md. Regression suite 183 → 203.

Added

• pty_read({ agent_transcript: true }) — recover an agent session's most recently completed turn's final assistant message in plain text from the vendor's structured session transcript. Fixes long answers being truncated by the wait:"agent_done" screen tail (pane height ≈ 24 lines). Codex joins on the Stop-hook turn_id; Grok/Composer take the assistant rows after the last real user row. Explicit errors instead of silent empties.
• pty_list now marks agent sessions (agent=<kind> agent_done=true, plus vendor_session_id once bound) so a resumable agent session is identifiable after an MCP server restart.
• codex_agent launch responses surface the inherited managed-config reality (mcp_servers count, approval_policy, sandbox_mode, hook-trust bypass) so a "review-only" child isn't silently full-access.

Fixed

• Stale agent wait locks are now reclaimed (dead-pid liveness check); a crashed waiter no longer blocks wait:"agent_done" on that session forever. closeSession/killAll also honor live cross-process wait locks. Agent metadata writes are atomic (temp+rename).
• reduceOutput bounds over-long single lines, so a TUI's absolute-cursor repaint stream can't blow the response token budget past the line-count fold.
• UTF-8 start-boundary safety for mid-multibyte offsets (8 MB truncation & incremental reads) — no more leading U+FFFD.
• The pytest reducer no longer replaces non-pytest output with a fabricated "Pytest: No tests collected" (evidence guard; golden fixtures stay byte-exact).
• Destructive-command tripwire absorbs -- (rm -rf -- /) and re-checks the post-rtk-rewrite text.
• Inverted line_range ("5:3") is an explicit error instead of a silent empty.
• Quiescence completion attribution is now deterministic: the stability window is re-validated after the foreground-shell probe, so output landing during the probe is attributed to its mark/until instead of quiescent (found by CI on slow macOS runners).

Tests

tools/call dispatch coverage (unknown tool / bad args / inverted range), wait-lock reclamation, transcript recovery for both vendor shapes, line/byte guards, tripwire gaps. 203/203 green on ubuntu & macOS, Node 18/20/22.