docs(release): record v0.12.2 reproducibility proof

[jeremi]

Summary

• record the public v0.12.2 P/T binary and OCI reproducibility proof
• bind the proof to the annotated tag, release workflow, and published image digests
• state the exact scope and exclusions of the reproducibility claim

Verification

• manifest validation
• versioned docs validation
• release source-model validation
• 62 release-script tests
• 12 source-model tests
• retained P1/P2/T1/T2 binary and image-input equality
• exact T OCI comparisons and P-to-T rootfs comparisons
• workflow artifact SHA-256 equality
• public-boundary scan
• git diff --check

Closes #127

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bbd328af4f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add the required DCO sign-off

The root AGENTS.md says every commit needs a DCO sign-off (git commit -s), but the reviewed commit message has no Signed-off-by: trailer. In this repository that means the DCO gate can reject this otherwise docs-only change until the commit is recreated with the required trailer.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Remove the closed #127 blocker from readiness

This commit adds the v0.12.2 repeatable-build proof and the commit message closes #127, but release/READINESS.md still lists GH#127 among the open supply-chain/provenance tracking issues. Once this lands, the readiness page will keep telling release reviewers that the repeatable-build evidence blocker is still open, so the status docs need to be updated alongside this proof.

Useful? React with 👍 / 👎.