chore(release): v0.12.2

[danielmeppiel]

TL;DR

Cut v0.12.2 -- a small patch release that ships the four PRs merged since v0.12.1, headlined by the parallel sub-path install race fix that was being re-reported by users on ADO (#1140).

What's in it

PR	Type	One-liner
#1137	Added	apm audit now catches forgotten installs and hand-edits by default (--no-drift to opt out)
#1135	Fixed	Parallel sub-path installs from the same repo@ref no longer race -- subdir-agnostic bare cache + per-consumer materialization. Fixes #1126 and the duplicate ADO report #1140
#1129	Changed	Docs: first-package guide -- corrects includes: auto behavior and skill deployment paths
#1127	Changed	Docs: clarifies APM's role for skills, unifies "plugin == package", adds ADO sub-path examples, states stability posture

Each PR gets exactly one "so what" line in CHANGELOG.md per the changelog contract.

Mechanics

• pyproject.toml: 0.12.1 -> 0.12.2
• uv.lock: re-locked (only the apm-cli package version changes)
• CHANGELOG.md: [Unreleased] block converted to ## [0.12.2] - 2026-05-05; [BUG] Can no longer depend on other skills etc in the same repo #1140 added to the fix(deps): subdir-agnostic bare cache fixes parallel sparse-checkout race (#1126) #1135 fix line; two new docs entries under ### Changed

Why now

#1140 lands the second user-visible report of the #1126 race in two days, both with the same Subdirectory '...' not found symptom and the same "run install twice" workaround. The fix has been on main since #1135 merged; getting it tagged unblocks ADO sub-path users without asking them to build from source.

Validation

• Lint: uv run --extra dev ruff check src/ tests/ && uv run --extra dev ruff format --check src/ tests/ (no source changes in this PR; only pyproject.toml, uv.lock, CHANGELOG.md)
• Tag/release pipeline kicks off automatically when v0.12.2 is pushed after merge (per .github/instructions/cicd.instructions.md: only v*.*.* tags trigger the full release pipeline).

Post-merge

1. Tag v0.12.2 on main and push -- triggers build-release workflow.
2. Verify PyPI + GitHub release artifacts, then update Homebrew tap.

---

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

This is a release-cut PR for v0.12.2. It bumps the package metadata to the new patch version and moves the four merged changes since v0.12.1 into a new released section of CHANGELOG.md, covering the drift-detection improvement, the subdirectory install race fix reported again on ADO, and two documentation updates.

Changes:

• Bump the project version from 0.12.1 to 0.12.2 in packaging metadata.
• Update uv.lock so the editable apm-cli package version matches the release.
• Convert the current unreleased changelog entries into a new 0.12.2 release section with four shipped PR summaries.

Show a summary per file

File	Description
pyproject.toml	Updates the published package version to 0.12.2.
uv.lock	Syncs the lockfile's editable apm-cli entry to 0.12.2.
CHANGELOG.md	Creates the 0.12.2 release section and records the four merged PRs in the changelog.

Copilot's findings

Comments suppressed due to low confidence (1)

CHANGELOG.md:23

• These entries also diverge from .github/instructions/changelog.instructions.md:18-20, which requires a single concise line per PR ending with (#PR_NUMBER). Keeping the docs PR bullets in the same one-line format matters here because this release section is what gets published verbatim.

- **Docs: `first-package` guide accuracy.** Clarifies how `includes: auto` actually behaves and corrects the skill deployment paths so a newcomer's first package matches what `apm install` writes to disk. (#1129)
- **Docs: APM's role for skills, plugins-as-packages, ADO sub-paths.** Six user-surfaced doc gaps closed in one pass -- unifies the "plugin == package" framing, adds ADO sub-path install examples, and states the current stability posture so users stop guessing from release notes. (#1127)

• Files reviewed: 2/3 changed files
• Comments generated: 2