v2.12.0 — factory run transport, trace bundle v1 & workflow board

Added

• Durable run transport on remote refs (#82) — run refs sync to origin on every state transition (throttled via ADLC_WORKFLOW_PUSH_INTERVAL, default 60s, 0 = every transition; exit paths push unconditionally). Pushes go through a throwaway staging copy: the wire is redacted, machine-local files (lease.json, .push-ts) never leave the host, and the local run dir keeps raw values for resume. Symlinks are never followed into pushed trees.
• Trace bundle v1 (#83) — every run carries trace/{manifest,events,artifacts}: ADR-362 event envelopes with canonical types, a manifest recording run-start and post-step SHAs, and content-addressed artifacts. Fail-closed retention (failed runs keep the full bundle; successful runs degrade to manifest-only unless ADLC_TRACE_SUCCESS_SAMPLE_RATE samples the run for full retention). Mid-run event streams stay off the remote until a terminal state.
• Cross-session e2e verification (#84) — a repeatable drill in npm test driving two separate adlc-cli sessions in two clones of one remote (run → pause → park → restore → resume → completed), asserting transport, redaction, envelope and retention invariants end to end.
• workflow board — factory pane of glass v1 (#85) — one view over all factory runs: local run dirs plus remote refs/factory-runs/* fetched namespaced (refs/remotes/<remote>/…, never touching local refs), with status, current step, trace outcome/retention, and issue ref. --format json emits the machine contract for the future dashboard; degrades to a local-only board (warning, exit 0) when the remote is unreachable.

Security

• Command injection via --remote in workflow board (#85) — remote names are validated by the same checkRemote guard as park/restore before reaching git fetch; the inline --remote=--upload-pack=<cmd> attack form is rejected with a usage error (exit 1).

---

Full changelog: CHANGELOG.md
Rollback: git revert of the release merge restores v2.11.0 behavior; pin v2.11.0 if needed.