fix: correct npm tarball URL format for scoped package

Scoped package tarballs drop the scope prefix in the filename:
  correct:   @node9/proxy/-/proxy-{version}.tgz
  incorrect: @node9/proxy/-/@node9/proxy-{version}.tgz

Also bump formula to v1.0.12 (actual latest on npm).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: nawi-25

.github/workflows/bump.yml

@@ -16,7 +16,7 @@ jobs:
         id: sha
         run: |
           VERSION="${{ github.event.client_payload.version }}"
-          URL="https://registry.npmjs.org/@node9/proxy/-/@node9/proxy-${VERSION}.tgz"
+          URL="https://registry.npmjs.org/@node9/proxy/-/proxy-${VERSION}.tgz"
           SHA=$(curl -sL "$URL" | sha256sum | awk '{print $1}')
           echo "version=$VERSION" >> $GITHUB_OUTPUT
           echo "sha256=$SHA" >> $GITHUB_OUTPUT

Formula/node9.rb

@@ -1,8 +1,8 @@
 class Node9 < Formula
   desc "The Sudo Command for AI Agents — execution security for Claude Code & MCP"
   homepage "https://github.com/node9-ai/node9-proxy"
-  url "https://registry.npmjs.org/@node9/proxy/-/@node9/proxy-1.0.9.tgz"
-  sha256 "184df78cae4076159d3ab973c9b61a4c06c22c31d16a02f2c036f24ae7543c38"
+  url "https://registry.npmjs.org/@node9/proxy/-/proxy-1.0.12.tgz"
+  sha256 "4b075b9d5bbd50195acd31f30c458b73fca174d065e2246496d771add44d1407"
   license "Apache-2.0"
 
   depends_on "node"