v0.12.12

## v0.12.12 — the production-fix release

14 PRs of the v0.12.11 candidate batch (absorbed per the two-phase flow — that candidate was tagged, validated, and superseded before witness) **plus five production fixes reported and shipped same-day**.

### Fixed, in production's own words
- **Recordings could freeze at first read (#768, P0)** — opening a recording mid-meeting permanently truncated it (observed in prod: a 4-hour meeting serving 6.6% of its audio). Masters are now re-assemblable; **already-frozen masters self-repair on the next read** — no data was lost, chunks were always stored.
- **>1000-chunk recordings silently truncated (#769)** — chunk listing paginates to exhaustion, with loud truncation guards.
- **`replicaCount>1` bought no real redundancy (#770)** — the chart now expresses `topologySpreadConstraints` (global + per-component, each component's own selector injected).
- **`helm upgrade` deadlocked agent-api (#774)** — RollingUpdate surge vs its RWO workspace PVC; now `Recreate` on RWO, RollingUpdate restored automatically under RWX.
- **`BOT_SPEAKER_*` tuning was dead config (#771)** — the runtime kernel never merged the profile's base env into spawns; chart-set tuning now reaches every bot.

### Witnessed live on the delivered deployment
Signed receipt: `releases/v0.12.12/witness.json` — 22 values, 4 walked live (including the #768 P0: mid-meeting master 6,959,152 B → post-completion 8,117,085 B — re-assembly proven on a live meeting), 18 by-proxy with named evidence.

### Also in this release
- feat(release): native arm64 smoke in release-validate (#630)
- fix(db-budget-gate): the pool scan counts production source — make the test filter express it (stacked on #703) (#704)
- test(admin-api): inline the pool literals — the budget gate excludes tests by contract (#702) (#705)
- governance(D-L4): the witness walks a DELIVERED deployment — enforced at the receipt (#709)
- release: v0.12.10 witness receipt — SIGNED (human witnessed the assembled value) (#711)
- governance: merge-card acceptance row — Closes cannot silently drop delivery legs (#719)
- fix(release-witness-gate): full 64-hex image digests or no pass — truncation rule + v0.12.10 record-completion (#720)
- docs(releases): step 4 — the publish act joins the runbook (gh release create + the guard it triggers) (#721)
- harness: least-privilege env for the model subprocess (scrub REDIS_URL + dispatch token) (#726)
- feat(gmeet): every segment carries the STT-detected window language (#523) (#760)
- fix(meetings): pre-active teardown attributes the reason from the status (#598) (#762)
- ci(pr-value): lite-smoke leg — build the PR lite image, boot it, smoke the front doors (#581) (#763)
- feat(deploy): make probe — standing full-journey smoke probe per surface (#690) (#764)
- fix(api.v1): 61 secured ops referenced a nonexistent APIKeyHeader scheme — resolve to ApiKeyAuth/AdminApiKeyAuth (#531) (#765)
- release: fold #765's fragment — v0.12.11 batch completion (#772)
- fix(runtime): kernel merges Profile.base_env into the spawn env — chart-set BOT_SPEAKER_* tuning reaches the bot (#771) (#775)
- feat(helm): topologySpreadConstraints (global + per-component, own-selector injected) · agent-api Recreate on RWO workspace PVC (#770 #774) (#777)
- fix(lite-smoke): bounded wait for internal admin-api — the leg's first real firing raced the boot (#780)

### Operator notes
- **Rolling-upgrade note for `TRANSCRIPTION_MODEL`**: set the new env only after bot images are on v0.12.12 — older bots reject invocations carrying unknown fields (sealed-schema validation).
- arm64 is now smoke-executed on native arm runners in every release run (#630 / #564).

### Credits
Reporters & authors this release stands on: the production incident review (#768 #769 #770 #771 #774 #779 #783), @Som23Git (#630 arm64 smoke), @waqaskhan137 (#489 → #522 model-id lineage), @mnofresno (#607/#621 seam work), @rennf93 (#573 lineage), and the standing reporter cohort. The witness walk and value sign-offs are recorded in the receipt.