v0.1.2 — Stronger evidence, safer reruns, a working first example

This maintenance update makes the existing agent-operated workflow easier to
trust and easier to pick up after a break.

What improved

• Approvals keep their history. Passed stages cannot be silently replaced.
  Explicit replacements retain the old ledger and must keep later approvals valid.
• Textures stay tied to the right mesh. The ledger checks the approved
  topology, exported FBX, baked maps and actual passing texture report by hash.
  Missing records and files with the right name but wrong contents are rejected.
• Failed runs cannot borrow an old success. Blender errors and missing outputs
  stop the run. Character compiles and production bakes keep separate attempts,
  and published asset directories are protected from replacement.
• Windows launchers behave consistently. PowerShell 5.1 receipts, ordinary
  stderr warnings, tool discovery and interpreter selection are handled correctly.
  The AI routes share GPU/ComfyUI preflight checks and retain interrupted attempts.
• Resuming takes less reading. docs/STATUS.md gives the current state;
  docs/HANDOFF.md keeps the history. The docs now include a stage/receipt table,
  an index and clearly separated experimental scripts.
• A fresh clone has something to compile. examples/crate/ contains a tiny
  CC0 mesh, texture and recipe, exercised through a real Blender bake, publication
  and FBX reimport. It is a mechanics example, not AI-generated artwork.

Also fixed: the default mascot rig adapter, custom-workspace geometry preflight,
delegated retopology review, concurrent ledger writes and installed-package checks.
Python dependency updates and private security reporting are now configured.

Updating

Update your checkout, reinstall with python -m pip install -e ".[dev]", and run
scripts\verify.ps1. For a first compile, follow examples/crate/README.md.
Ledger-only users can install the attached wheel and run rac --help.

Existing output directories are retained. Choose a new asset id for another
published derivative, or a new --production-name prod-v3 for another production
bake. Historical ledgers missing the newly required bindings fail audit until
the evidence is supplied and reviewed; approvals are not migrated automatically.

Validated on Python 3.11 and 3.12 with CPU-only tests, isolated wheel installations,
Windows PowerShell runtime checks and a Blender 5.2.1 fixture. No AI inference or
existing asset approval was needed for this update.