v0.12.1

Vexa **v0.12.1** — the first pipeline-clean release. Same product surface as 0.12.0; this
release exists to prove the ship bar itself: every image built, published, and validated by the
release machinery (0.12.0's images were hand-pushed around a broken matrix). It also lands the
governance system and two security dependency waves.

## What's in it

- **Governance system on `main`** (#505) — two constitutions + three protocols
  (PREPARE / TAKE / MAINTAIN) as one `delivery` law, with the AGENTS.md front door. 9 docs → 4.
- **Security dependency waves** — #517 (pytest out of runtime deps → dev groups, GHSA-6w46-j5rx-g56g)
  and #521 (esbuild ≥0.25, postcss ≥8.5.10, vite 8.1.4 — Dependabot 137/141/143/169/178/179).
- **Release machinery** (#494) — the release-images lane (build → publish → prove → promote).
- **Maiden-run bug paydown** — the first real ship-bar run fixed four latent defects the
  hand-pushed 0.12.0 hid: Docker Hub CI creds, the nonexistent `clients/dashboard` matrix entry
  (#549, executes the dashboard-deprecation ruling at the artifact level), the lite STT-gate 503
  in the smoke (#550), and the `POST /bots → 502` startup race in the concurrent-bots smoke
  (readiness gate added).
- **Release machinery split** (#551/#554) — build+publish is now separate from validate+promote,
  so a validation-harness fix re-runs the verdict in minutes without rebuilding unchanged images.

## Validated on (coverage statement)

Proven on what we name — all legs pull the **published** `:v0.12.1` images, never a local build:

- **Lite (self-host compose)** — front doors green + **concurrent-bots smoke on a fresh
  us-sea VM** (2 bots, isolated profiles, 45s stable) AND CI `validate-lite`. `release/vm-validated`
  posted on the release commit.
- **Compose (full stack)** — `validate-compose`, `validate-mock-fsm`, real bot spawn
  (`validate-bot-spawn`).
- **0.10 API backward-compat** — `validate-v010-compat` (passes + recorded `V010-BREAK:` xfails only).
- **Kubernetes / Helm** — `validate-helm-k3s` (ephemeral single node, gateway `/health` + all pods Running).
- **Image identity** — every published image proven to contain what its name promises.

Honestly unclaimed: arm64 (amd64-only this release; tracked follow-up), and the hosted STT path
under load (the internal fallback token is capacity-saturated — an ops item, not a release defect).

## Pointers

`:v012` now moves to `v0.12.1` on all images. `:latest` unchanged. `vexaai/vexa-bot:{dev,latest}`
untouched (0.10 line).