chore: release v0.12.0

[avrabe]

Summary

Cuts v0.12.0 — four landed PRs since v0.11.0 (2026-05-24):

• ci(release): adopt synth artifact-verification pattern (SBOM, sums, cosign, SLSA) #186 Release pipeline standardization (synth flow: SBOM, sums, cosign, SLSA, build-env)
• docs(release): consumer verification one-liner (cosign + gh attestation) #187 README consumer verification recipe (`cosign verify-blob` + `gh attestation verify`)
• feat(p3_stream): static stream cycle detection at fusion time (#142 iii) #188 Static stream cycle detection at fusion time (P3 async — static stream validation at build time (#94 sub-B) #142 (iii), LS-R-12, iterative Tarjan via LS-R-13)
• ci(fuzz): force RUSTFLAGS=-C target-feature=-crt-static (#168 defense) #189 Defensive RUSTFLAGS in fuzz workflow against smithy: sanitizer/libc config drift recurrence on fuzz smoke jobs #168 drifted-runner pattern

v0.12.0 is the first release published with the new artifact flow — per-target `.tar.gz` archives, CycloneDX SBOM, cosign-signed `SHA256SUMS.txt` + bundle, and SLSA v1 build provenance per archive. v0.11.0's binaries were the last bare-asset release.

Test plan

• `cargo check --workspace` clean on 0.12.0
• Full `cargo test -p meld-core --lib` passes
• Pre-commit hooks pass (`cargo-fmt`, `cargo-clippy`, `cargo-test`)
• CI green on this PR
• After merge: tag `v0.12.0` triggers `release.yml` end-to-end (first real test of the synth-pattern flow)

🤖 Generated with Claude Code

[github-actions]

LS-N verification gate

⚠️ 34/35 verified — 1 missing regression tests

	count
Passed (≥1 test, all green)	34
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	1

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

• LS-R-13

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}