Document v1.2.1 platform qualification waivers

.out-of-scope/v1.2.1-external-platform-qualification.md

@@ -0,0 +1,51 @@
+# v1.2.1 external platform qualification waiver
+
+Release owner Brett Kinny accepted on 2026-08-01 that the immutable v1.2.1
+Release may proceed without manual Fedora SELinux/rootless Podman, macOS Docker
+Desktop, native Windows PowerShell 7 and Git Bash, or physical arm64 runs. These
+criteria are waived, not passed.
+
+## Why this is out of scope
+
+This is a permanent decision for the v1.2.1 Release identity once published,
+not a reusable rejection of platform qualification. It is recorded here
+because #127, #128, and #129 will be resolved as `wontfix`. Only #131's
+physical-arm64 criterion is waived; #131 remains open. This record must never
+be used to deduplicate or reject qualification work for a later Release. Each
+later Release must create fresh qualification issues and reassess its manual
+gates.
+
+Prerelease qualification through `v1.2.1-rc5`, source
+`8f56f759acdf735c50e1bd0464dd852c28618deb` and image digest
+`sha256:861dd7c2ae0e69ae18641bb3817ed0647570c5527b3b3354bfc8f073817b55f5`,
+completed the automated multi-architecture Candidate suite, artifact and
+signature verification, real physical-amd64 Linux Docker lifecycle testing,
+genuine UID/GID 2000 Linux testing in a KVM guest, and Codespaces
+create/rebuild testing. A mechanical retained-v1.1-home migration also passed
+with synthetic authentication, Selection, and Workspace markers; real
+authentication and prompt behavior are not claimed by that evidence.
+
+The final protected `v1.2.1` Candidate does not exist yet. It must repeat every
+automated build, Evidence, artifact, signature, and emulated-arm64 gate. It also
+still requires desktop VS Code Dev Containers UI evidence under #130, native
+physical-amd64 exact-digest qualification, draft verification, protected
+environment approval, immutable publication verification, alias checks, and
+the non-rewind proof under #131.
+
+## Affected release criteria
+
+For v1.2.1 only, #125 no longer requires #127, #128, or #129 to produce a manual
+pass, and no longer requires the physical-arm64 portion of #131. All other #125
+and #131 criteria remain required.
+
+This waiver does not remove or change existing platform support status.
+Podman remains experimental. Failures reported on any documented path remain
+valid bugs.
+
+## Prior requests
+
+- #127 — Fedora SELinux/rootless Podman manual qualification
+- #128 — macOS Docker Desktop manual qualification
+- #129 — Windows PowerShell 7 and Git Bash manual qualification
+- #131 — physical-arm64 criterion only; the issue remains open for every other
+  final-Candidate and publication criterion