chore[notask]: release sdk + bare-sdk 0.12.3 — bump bare-fetch ^3.0.1

[lauripiisang]

What changed

• @qvac/sdk and @qvac/bare-sdk prod dependency bare-fetch bumped ^2.5.1 → ^3.0.1.
• @qvac/sdk dev dependency bare-subprocess bumped ^5.2.3 → ^6.1.0.
• Both package versions bumped 0.12.2 → 0.12.3 (lockstep — the publish workflow fails if packages/sdk and packages/bare-sdk versions differ).

Skipped bare-* bumps

The following are same-major carets that already resolve to the latest version within their major at install time, so no edit is needed:

• @qvac/sdk: bare-abort-controller, bare-crypto, bare-fs, bare-os, bare-pack, bare-process, bare-rpc, bare-runtime, bare-stream, bare-zlib, bare-readline (dev), bare-url (dev).
• @qvac/bare-sdk: same same-major-caret list minus bare-subprocess / bare-readline / bare-url, which bare-sdk does not depend on.

Already at latest within their declared range:

• bare-net ^2.3.2 and bare-path ^3.0.1 are already at the latest.
• bare-link >=3.0.0 peer range already covers 3.2.2.

Migration note

• bare-fetch 2→3 is a transitive-only major: the public fetch API is unchanged. The only 3.x behavior change is 3.0.1 header validation, and all SDK header usages (new Headers({ 'User-Agent': ... }), append('Range', 'bytes=…')) build RFC-valid headers. The bare-tls trust-store change already ships at 2.x via bun.lock.
• bare-subprocess 5→6 is dev-only. Every spawnSync site gates on status === 0, so a null status still takes the failure branch; signal reads only feed log strings.
• No source changes required.

🤖 Generated with Claude Code

[simon-iribarren]

Approved after checking CI and the focused release/backmerge diff. The package version, dependency, and changelog changes match the requested release artifacts.

[github-actions]

Tier-based Approval Status

**PR Tier:** TIER1

**Current Status:** ✅ APPROVED

**Requirements:**
- 1 Team Member approval ✅ (1/1)
- 1 Team Lead OR Management approval ✅ (1/1)



---
*This comment is automatically updated when reviews change.*

[lauripiisang]

Superseded by the 0.13.x cleanup (#2578 / backmerge #2579). The 0.12.3 line is based on published 0.12.2, whose addon ranges (transcription-whispercpp ^0.7.0, ocr-onnx ^0.5.0, transcription-parakeet ^0.6.0) pull stale transitive deps (@qvac/response → bare-events 2.4.2, bare-fetch 2.x) regardless of sdk-level bumps — a clean install proved it can't produce a clean tree. Closing in favor of 0.13.1.