v1.12.2

Round-2 security audit fixes + CI/supply-chain hardening.

Client/daemon fixes:

• Fix daemon rotate-key data race: old Ed25519 private key was zeroed while a concurrent signer could still read it (use-after-zero on signing material).
• pilotctl recovery now backs up identity.json before overwriting it.
• Auto-updater: fail closed when gh is absent (SLSA attestation can no longer be silently skipped); bump updater to v0.2.3; add --skip-attestation / PILOT_UPDATER_SKIP_ATTESTATION opt-out.
• Repoint dead changelog/MOTD feed URLs to the pilot-protocol org.

Security CI + evals:

• Add CodeQL, gosec, govulncheck, gitleaks, dependency-review gating and adversarial fuzz/eval suites (badge IPC, keyexchange frames, node-binding).
• Bump toolchain to go 1.25.11 (stdlib advisory fixes).

What's Changed

• Add pilotctl auto-update control surface (off by default) by @TeoSlayer in #304
• catalogue: sixtyfour v2 bundles map (fix macOS + Linux install) by @Alexgodoroja in #306
• Security hardening batch: updater attestation opt-out, recovery backup, feed repoint, trust-pin TODO by @TeoSlayer in #307
• Fix data race between key rotation and registry signer by @TeoSlayer in #308
• Bump updater to v0.2.3 for fail-closed attestation by @TeoSlayer in #309
• Add supply-chain CI gates and adversarial fuzz evals by @TeoSlayer in #311

Full Changelog: v1.12.1...v1.12.2