security: release 1.2.1

[hkimw]

Fix two security issues affecting SDK versions <=1.2.0: protected workspace path reads and creation through Windows short-name aliases, and memory exhaustion during nested default expansion. Prepare version 1.2.1 with updated installation/security guidance and generated version identifiers. Public APIs, declarations, schema contracts and package exports remain compatible.

Validation:

• npm run check: 524 runtime tests passed, no skips; public/API/schema checks, TypeScript declarations, example and independent packed consumers passed.
• 50 package exports, 315 runtime names, 56 declaration files and 107 schemas retain their reviewed contracts; generated schema changes only update version identifiers.
• A fresh 454-file archive from the exact branch commit passed an offline, script-disabled install with an empty npm cache, all 49 runtime export imports and a diagnostics smoke check; it has zero runtime dependencies.
• Independent review reproduced four regressions before the fix and passed all 32 focused tests after it. All six fix files match the independently reviewed bytes.
• Public SDK CI: all four GitHub-hosted Windows/Linux × Node 22/24 jobs passed, including the existing synthetic benchmarks and combined workload regression guard.

The historical candidate benchmark record includes an initial failure and a passing unchanged-candidate confirmation; performance thresholds remain unchanged.

This PR prepares the patch for review. Release publication and npm registry publication are separate actions.