v1.12.1

Security

• CodeQL code-scanning close-out (SEC-1..SEC-6). All GitHub workflows now declare
  least-privilege GITHUB_TOKEN permissions (contents: read baseline; publish jobs keep
  their elevated per-job grants). Synapse session IDs are generated by a single shared
  newSynapseSessionId() helper backed by crypto.randomUUID() instead of the duplicated,
  guessable Math.random() template. The code chunker's inline block-comment stripping is
  a linear single-pass scan, removing a quadratic-regex indexing stall on minified or
  adversarial single-line files. sanitizeFilePath removes ../ traversal tokens to a
  fixpoint so overlapping tokens like ....// can no longer smuggle a live traversal
  segment through a single pass. The unused isValidEmail export (quadratic regex, no
  production callers) was deleted. Compaction snapshot retrieval calls now interpolate
  values via JSON.stringify, closing a backslash-quote escape gap.