release: add human-reviewed findability conventions for v1.12.0

[sergeliatko]

What changed

• Add a focused runtime workflow for repository findability and shared artifact conventions.
• Require human discussion before convention adoption and separate acceptance from exact write authority.
• Promote local success to portfolio use only through representative evidence, an explicit target list or reviewed snapshot, and per-target revalidation.
• Add Architecture Decision 0007, threat controls, feedback discoverability, fixture mapping, and seven findability evaluation cases.
• Prepare synchronized v1.12.0 package, plugin, changelog, version, and release-note metadata.

Why

Issue #48 exposed a retrieval-aware planning practice that was broader than one naming example. The runtime had useful but distributed cues for findability, practice reuse, approval, and cross-repository authority. It did not define consumer testing, a human convention proposal, or a scalable but bounded path from local success to portfolio adoption.

The new workflow keeps conventions conversational and reversible by default. It does not add a taxonomy, profile, registry, connector, manager service, feedback-artifact directory, or automation interface.

User and developer impact

Humans now receive the proposed convention for discussion before files change. Agents compare no change and scoped adaptation, test actual human, agent, and tool consumers when authorized, preserve legacy compatibility, and cannot infer portfolio write authority from a local success or positive comment.

GitHub Issues remain the feedback and task surface. Accepted operational evidence that validates or extends runtime behavior maps to an existing or proposed fixture without adding reporter burden.

Traceability

• Closes [Feedback]: Portfolio practice reuse produced a retrieval-aware planning convention #48.
• Architecture Decision 0007 records the source-boundary decision, alternatives, consequences, and review triggers.
• findability-and-conventions.md owns the runtime behavior.
• The threat model covers convention authority drift, stale snapshots, hidden copied authority, private topology, and migration risk.
• The v1.12.0 evaluation record captures four fresh-agent reviews, one repaired ambiguity, and the inert adversarial proof boundary.
• The v1.12.0 release notes record compatibility and package inspection requirements.

Validation

• npm run test:eval: 75 cases across 18 segments.
• npm run validate: pass.
• Four bounded fresh-agent behavior reviews: pass after one sequencing repair and recheck.
• Adversarial fixture: deterministic and static review only because the maintainer host cannot provide credential-free model-test containment.
• npm run package -- v1.12.0: pass.
• npm run release:verify-assets -- v1.12.0: pass.
• Manual inspection: all three ZIP inventories clean, manifest hashes matched, and 14 runtime files were byte-identical across packages.
• npm run release:preflight -- v1.12.0: pass, including unused remote identity, gh skill publish --dry-run, two deterministic builds, and unchanged candidate-tree verification.

Candidate tree SHA-256: 6e9bc0990deeb3698e1cf6c096acec91319cc32bfe8636e67d13692247e991bd.

This pull request is intentionally draft. Technical releasability does not authorize publishing the final GitHub Release.