Stamp the changelog for 0.12.0

[LeeJMorel]

Changelog only — no code. Stamps 0.12.0 ahead of pushing the v0.12.0 tag, which is what actually cuts the release.

Covers the 27 commits since v0.11.2:

• Upgrading no longer means dropping the database (T99) — ordered, recorded schema steps replacing the single fingerprint; old databases adopted in place.
• Removing an app takes every credential with it (Delete and revoke member credentials when an install is removed #30) — deletion plus grant revocation at GitHub, and per-member reconciliation on each sync.
• A webhook is answered before the work (Delete and revoke member credentials when an install is removed #30) — outbox with backoff, deferred install resync.
• A delivery is accepted once (T99) — the lease ledger.
• Rate limits are read rather than guessed at (Delete and revoke member credentials when an install is removed #30) — all three GitHub signals, told apart from a plain permission 403; repository listing cached and webhook-invalidated.
• The setup token is asked for, not typed into a URL (T98).
• Container pinning (T60), security policy (T91), CI hardening (T126/T130), kit v0.20.0, node 26, vitest 5.

Version chosen as a minor bump: this adds features, a new env var (OUTBOX_INTERVAL_SECONDS), and changes operator-visible behaviour in the setup route and schema migration, none of which a patch label would convey.