Release v1.2.1 from one qualified Candidate

[BrettKinny]

This was generated by AI during triage.

Type: HITL

What to build

Freeze one source revision, qualify one immutable multi-architecture Candidate, and publish that exact Candidate as Squarebox v1.2.1 without rebuilding or retargeting a protected tag.

The protected v1.2.0 Candidate remains an unpublished NO-PROMOTE audit artifact. The v1.2.1 Candidate includes the merged Dev Container persistence fix and the reviewed v1.2 scope.

No per-platform manual qualification matrix is planned for v1.2.1. Automated Candidate Evidence is authoritative; concrete platform defects remain valid issues when discovered.

Acceptance criteria

• Included changes are based on current main, reviewed for ADR/lifecycle compatibility, and pass repository-tests, build, and build-arm64.
• Version-facing changelog, migration, README, UAT, and demo surfaces describe v1.2.1; pinned tool versions are refreshed transactionally.
• A v1.2.1 prerelease Candidate passes automated build, scan, Evidence, signing, asset verification, and publication.
• The protected final v1.2.1 tag produces one draft Candidate whose source SHA, image digest, release assets, and Evidence agree.
• Primary Linux smoke/lifecycle checks in Qualify v1.2 Linux Docker and interactive setup #126 are either completed or explicitly accepted as remaining non-gating follow-up.
• Human approval publishes the already-qualified draft without rebuilding; GitHub and GHCR aliases resolve to the greatest stable Release.
• Release attestation, asset hashes, Sigstore bundle, image signature, and historical-rerun non-rewind behavior are verified and linked here.
• Final Candidate verification and the explicit promote/no-promote decision are recorded in Verify final v1.2.1 Candidate and publish #131.

Blocked by

None - can start immediately.