chore: bump to 1.12.0 — the Python floor reaches consumers

[Polichinel]

Step 1 of the release ritual in publishing_to_pypi.md §C. Bump only — src/ untouched.

MINOR, not patch: the supported environment set grew. requires-python moved >=3.12 → >=3.11 in #444, and nothing reaches anyone until a release, because PyPI metadata is built from pyproject.toml at release time. Until the tag exists, the 28 views-models requirements files stay blocked on a floor this repository no longer declares.

Same shape as v1.11.0: the wheel is byte-identical apart from metadata.

What this release carries

	Since	Where it has been sitting
Python floor >=3.11 (#443/#444)	today	development, no tag
C-331 — heartbeat URL off the curl command line	#432	development, no tag, so not on the server
C-343 — the refresh_pipeline.sh header that used to say deploying was one step	#431	same

The last two are production shell changes. The box runs v1.11.0 and cannot have them until the redeploy that follows this.

Step 0 — credential review gate: pass

publishing_to_pypi.md §C.0 requires checking ADR-026 §7 before releasing. All four credentials review 2026-11-30; today is 2026-08-13. Nothing overdue, nothing rotated, no date moved — which is the failure that check exists to prevent.

A gate fired, and the fix is not the cheap one

TestF7ProductPlanCurrency failed on the bump: the product plan's title read "current through v1.11".

I did not edit the title green. The plan's convention is an addendum per release — v1.10 and v1.11 both have one — so v1.12 got a real one covering why the floor was never chosen, the permanently forked raster stack, the LZW hole the change exposed rather than caused, and C-347/348/349. The title followed.

Editing only the title would have been this repo's named anti-pattern: the cheapest path to green rather than the honest one.

Verification

pytest exit 0 · ruff clean · mypy src/ clean · uv lock --check clean · validate_docs.sh PASSED.

Next

Promotion development → main as a merge commit (a squash rewrites release SHAs), then tag, GitHub Release, and the back-merge. #442 was closed in favour of that promotion — its body had drifted from its contents.

🤖 Generated with Claude Code