v2.1.2

Changed

• CI/release hardening: version-guard now treats the committed build/ bundle as shipped bytes (closing the lockfile-only and devDep silent-never-publish vectors) with an npm version-collision check; publish.yml gained a daily self-healing watchdog, manual dispatch, exact-version skip, CI-validated-commit checkout, and GitHub-Release self-heal; Dependabot bundle rebuilds now auto-bump a patch version; CI boots the committed bundle standalone on Node 20 every run; the bundle is now built with --target=node20, making the engines.node >= 20 claim enforced at build time.
• requirements.txt is now exact-pinned and under Dependabot pip management; CodeQL scans the Python sidecar.

Documentation

• docs/FULL-DISK-ACCESS.md — adds a "still failing after granting every host app?" section (#37 follow-up): on at least one confirmed setup, TCC attributed the FDA check directly to the node binary itself, not to any wrapper app — responsibility never climbed past node to see those grants. Documents the definitive diagnostic (log stream --predicate 'subsystem == "com.apple.TCC"', reading the Resp: process from the denial) and the fix (grant FDA to the exact node path the log names), plus the ad-hoc-vs-Developer-ID-signature note on why the grant may or may not survive a Node upgrade.