v1.2.1: execution isolation and gRPC security fixes

v1.2.1: execution isolation and gRPC security fixes

This maintenance release fixes correctness and security issues discovered after
v1.2.0. It does not change the public Go or gRPC API, generated protobufs, or
database schema.

• Fence child-workflow results by the execution captured when the child starts.
  A result from an older parent execution cannot complete a replacement
  execution after cancellation, purge, or recreation.
• Generate new automatic child instance IDs from the full scheduling action and
  the parent execution, preventing collisions across generations and actions.
  Existing retry histories retain their recorded child IDs.
• Preserve workflow execution identity through SQL admission, caches, delayed
  starts, cancellation cleanup, and transport retry handling.
• Update google.golang.org/grpc from v1.83.0 to v1.83.2. This fixes
  GO-2026-6348 and
  GO-2026-6443. The resolved indirect
  golang.org/x/net and golang.org/x/text modules also advance to v0.58.0
  and v0.41.0 respectively.

Upgrade notes

No schema migration is required. Before deploying this version, drain or migrate
queued legacy child results that lack captured parent-execution provenance.
Coordinated SQL writers must be upgraded together: an ambiguous legacy result is
rejected rather than being delivered to a potentially different execution. See
the child execution isolation guide
for the operational boundary.

Validation

The execution-isolation runtime commit
a21db2d
passed the full local suite, go vet ./..., targeted race checks, and isolated
PostgreSQL child/cancellation and purge/recreation races. The follow-up chaos
test commit
12133d3
ran all five isolated PostgreSQL crash/restart scenarios successfully. Its
runtime content was unchanged from a21db2d; the helper confirms the crash
before restarting the same container. Its 60-second observation window preserves
the pre-expiry and post-expiry assertions while accommodating measured PostgreSQL
recovery.

The dependency-only commit
8a7f7c4
passed go test ./... and govulncheck -show verbose ./... with no reported
vulnerabilities. Its build
and OpenTelemetry collector
checks completed successfully. These checks are evidence for this source release;
they do not prove a downstream deployment or migration was performed.