release: ClawFix 0.12.0

[arcabotai]

Summary

Prepare ClawFix 0.12.0 and close the release gap after 0.11.2.

• ships the chat-first standalone TUI with glibc, baseline, and Alpine/musl release gates
• expands the guarded repair catalog from one repair to five
• fixes repair apply/rollback correctness and disables unsafe batch repair
• hardens consent, text redaction, SSE limits, upstream cancellation, and conversation retention
• adds Resend webhook idempotency and truthful privacy/artifact copy
• adds TUI tests/typechecking, Alpine PTY smoke, checksums, and build attestations

Local evidence

• focused Node/release/privacy/repair suites passed
• PTY negative gates reject ignored input and nonzero exit
• npm dry-run manifest verifies 21 allowlisted files for 0.12.0
• workflow YAML parses and git diff --check passes

Deferred intentionally

• issue Re-evaluate update integrity detectors from superseded PR #2 #8 detector candidates remain separate until each has current positive/negative fixtures and safe advisory semantics
• diagnosis database retention is disclosed accurately; no destructive retention policy is introduced in this release