chore[skiplog|notask]: backmerge release-sdk-0.12.3 — version bump, bare-fetch ^3.0.1, dev bare-subprocess ^6.1.0, changelog

[lauripiisang]

What this PR does

Backmerges the @qvac/sdk@0.12.3 + @qvac/bare-sdk@0.12.3 (lockstep) release metadata onto main per gitflow "Keep main aligned". [skiplog].

Companion release PR

• chore[notask]: release sdk + bare-sdk 0.12.3 — bump bare-fetch ^3.0.1 #2562

Files

• packages/sdk/package.json — version 0.12.2 → 0.12.3; bare-fetch ^2.9.1 → ^3.0.1 (prod); dev bare-subprocess ^5.2.3 → ^6.1.0
• packages/bare-sdk/package.json — version 0.12.2 → 0.12.3; bare-fetch ^2.9.1 → ^3.0.1
• packages/sdk/changelog/0.12.3/ + packages/sdk/CHANGELOG.md — changelog

Conflict resolution note

The release was cut off the published 0.12.2 commit, whose sdk/bare-sdk dep block differs from main (main has bare-crypto ^1.15.0 and dropped the bare-events line; the published base had bare-crypto ^1.13.4 + bare-events ^2.8.0). The cherry-pick conflict was resolved surgically: main's current dep lines are preserved and only bare-fetch is changed to ^3.0.1. No bare-crypto/bare-events reversion.

Skipped bare-* bumps

• bare-abort-controller, bare-crypto, bare-fs, bare-os, bare-pack, bare-process, bare-rpc, bare-runtime, bare-stream, bare-zlib, bare-readline (dev), bare-url (dev) — same-major carets; install resolves latest within major.
• bare-net ^2.3.2, bare-path ^3.0.1 — already at latest.
• bare-link >=3.0.0 (peer) — range already covers 3.2.2.

Migration note

bare-fetch 2→3: transitive-only major; public fetch API unchanged. Only 3.x change is 3.0.1 header validation — all sdk header construction is RFC-valid. bare-tls trust-store change already ships at 2.x via the lockfile. bare-subprocess 5→6 is dev-only; every spawnSync site gates on status===0 (null still takes the failure branch) and signal reads only hit log strings — no source changes required.

[simon-iribarren]

Approved after checking CI and the focused release/backmerge diff. The package version, dependency, and changelog changes match the requested release artifacts.

[github-actions]

Tier-based Approval Status

**PR Tier:** TIER1

**Current Status:** ✅ APPROVED

**Requirements:**
- 1 Team Member approval ✅ (1/1)
- 1 Team Lead OR Management approval ✅ (1/1)



---
*This comment is automatically updated when reviews change.*

[lauripiisang]

Superseded by 0.13.1 backmerge #2579 (carries decoder-audio ^0.4.0 + bare-fetch ^3.0.1 + decoder.ts fix onto main). Closing with the 0.12.3 release PR #2562.