release: DS Agent v1.2.0 GoalEnvelope Step 2

[Lee-take]

Summary

• preserve the exact C2A -> C2B -> C2C history and merge the published v1.1.0 baseline without rewriting either line
• expose a bounded DeepSeek GoalEnvelope proposal while keeping Kernel-only validation, freeze, evidence, and completion authority
• add additive lifecycle/completion projections, a read-only UI projection, and fail-closed exact evidence coverage
• prepare the honest v1.2.0 unsigned Windows release metadata and retain all R1 isolation and migration safeguards

Verification

• focused GoalEnvelope proposal, lifecycle, migration, idempotence, UI, and completion-boundary tests
• production frontend build and cargo fmt --check
• full pnpm@9.15.9 test: 919 passed, 7 ignored by design, 0 failed
• release-source: 217 source-only files; secret scan: 217 files / 5 self-tests
• candidate x64 NSIS build plus static payload/version/hash/Auth inspection
• isolated standalone-candidate and installer-extracted UI + workflow smoke; no Key, paid API, user AppData, or installer execution

Release boundary

This PR does not add Step 3/C3A, grouped authorization, new Office/connector/Computer Use execution, production external accounts, or external-write authority.

Both ds-agent.exe and the planned DS.Agent_1.2.0_x64-setup.exe are intentionally Authenticode NotSigned. Windows may display Unknown publisher or a Microsoft Defender SmartScreen warning. SignPath remains submitted/pending; no signing identity or approval is claimed.