v1.12.3

What's Changed

• Fix gitleaks license gate and macOS test TMPDIR in CI by @TeoSlayer in #312
• Harden daemon IPC/transport correctness and DoS sizing by @TeoSlayer in #314
• Use writable /tmp TMPDIR for tests on both CI runners by @TeoSlayer in #316
• Fix config and CLI correctness/safety bugs in pilotctl by @TeoSlayer in #313
• Harden app-store install path and cap-state reads by @TeoSlayer in #315
• catalogue: publish Smol Machines (io.pilot.smolmachines v1.2.0) [needs re-sign] by @Alexgodoroja in #319
• appstore: carry install.json/install.sh on install + wire trust anchor by @Alexgodoroja in #318
• daemon: drop PILOT_TRUSTED_PUBLISHERS wiring (catalogue is the trust anchor) by @Alexgodoroja in #320
• chore(release): CHANGELOG for v1.12.0 by @TeoSlayer in #300
• docs: staged TLS+pinning rollout for registry transport (H1) by @TeoSlayer in #310
• Update README.md by @TeoSlayer in #299
• go.mod: bump app-store to the proc.exec version by @Alexgodoroja in #317
• Pin app-store to v1.0.1 release tag by @TeoSlayer in #321
• Fan out release to PyPI, npm, and Homebrew by @TeoSlayer in #322
• Drop push-based downstream fan-out in favor of self-polling by @TeoSlayer in #323
• daemon: anchor catalogue apps to the catalogue publisher pin (companion to app-store#25) by @Alexgodoroja in #324

Full Changelog: v1.12.2...v1.12.3