chore: promote v1.2.0 release to main

[peg]

Summary

• Promote the v1.2.0 release candidate from staging to main.
• Include the hosted approval API foundation, Hermes audit/tool-call correlation, OpenClaw plugin discovery default preservation, and audit-chain recovery hardening.
• Align release-facing docs, installer examples, bundled OpenClaw/Hermes plugin metadata, runtime-exported plugin versions, and the bundled OpenClaw policy stamp to 1.2.0.

Validation

• GitHub Actions passed on the latest staging merge commit 4e292a6.
• Verified OpenClaw and Hermes bundled metadata/runtime versions report 1.2.0 on the exact origin/staging tree.
• OpenClaw: go test -count=1 ./internal/plugin/openclaw ./internal/openclaw ./internal/openclaw/hardening ./internal/bridge.
• OpenClaw plugin regressions: node internal/plugin/openclaw/smoke-test.mjs, degraded-mode-test.mjs, tool-alias-test.mjs, and approval-regression.mjs.
• Hermes: go test -count=1 ./internal/plugin/hermes ./internal/proxy and python3 -m unittest internal/plugin/hermes/test_hermes_plugin.py.
• Hermes isolated policy-gate proof: exact staging build served a marker policy, denied the marked Hermes terminal call, allowed an unmatched Hermes terminal call, emitted correlated agent: hermes audit entries with tool_call_id, and passed rampart audit verify on the generated audit chain.
• Setup/help smoke: go run ./cmd/rampart setup openclaw --help and go run ./cmd/rampart setup hermes --help.
• git diff --check origin/main...origin/staging.

Notes

• Hermes support remains intentionally described as an experimental policy gate / hosted approval foundation, not full hosted approval/resume support.
• The audit recovery hardening fixes future restart/recovery behavior; it does not rewrite or repair already-broken historical audit chains.