release(v1.12.1): ssh-lan.conf Include fix, pi-studio v0.10.2, gitea-mcp v1.10.0

Patch release. The fix itself is c693aa3: setup-lan-access.sh now writes the
ssh-lan.conf Include whether or not the file exists at container start.

Upstream survey on 2026-10-19 (check-doc-drift check 9, npm, PyPI, tags, and
the GitHub/Gitea release APIs for every base tool pinned to `latest`):
- moved: pi-studio v0.10.1 -> v0.10.2 (4b4abd1), pi-toolkit 3760d90 -> 7c05901,
  gitea-mcp v1.9.0 -> v1.10.0
- unchanged: pi 1.3.0, mempalace 3.11.0, pi-atelier v0.16.0, pi-obsmem 022da5e,
  pi-extensions, pi-fork, mempalace-toolkit, skillset snapshot, and every
  other base tool
Audits, all on tor-ms22:
- pi-studio 0.10.2: lockfile packages identical to 0.10.1's. Loaded into
  pi 1.3.0, it registers the same 4 studio_* tools, rc 0.
- pi-toolkit: the new model IDs are in pi 1.3.0's bedrock registry, and they
  reach fresh volumes only (the settings merge fills only missing keys).
- gitea-mcp 1.10.0: stdio tools/list gives 58 -> 61 tools, none removed, and
  stdout carries JSON only.

CHANGELOG: Unreleased -> v1.12.1 with the components table and the audits.
README: "Since v1.12.1". Dockerfile.base: BASE_REBUILD_DATE marker refreshed;
the base rebuilds anyway because rootfs changed.
check-doc-drift rc 0, lint-shell, the link-pi contract tests, skill-floor and
the Dockerfile directives check: all clean.

README.md

@@ -1175,12 +1175,13 @@ set `DEVBOX_LAN_AUTOJUMP_PRIVATE=1` to ProxyJump *any* RFC1918 address through
 the host without naming peers (see `.env.example`).
 
 ssh reads the file on every connection, so creating it and editing it both take
-effect immediately — no container or session restart. `setup-lan-access.sh`
-writes the `Include ~/.config/devbox-shell/ssh-lan.conf` line whether or not the
-file exists yet (ssh skips an `Include` whose file is missing). Images up to and
-including v1.12.0 wrote that line only if the file was readable at container
-start. There, a file created afterwards is ignored until a restart, or until you
-run `bash /usr/local/lib/pi-devbox/setup-lan-access.sh` in the container.
+effect immediately — no container or session restart. Since v1.12.1,
+`setup-lan-access.sh` writes the `Include ~/.config/devbox-shell/ssh-lan.conf`
+line whether or not the file exists yet (ssh skips an `Include` whose file is
+missing). Images up to and including v1.12.0 wrote that line only if the file
+was readable at container start. There, a file created afterwards is ignored
+until a restart, or until you run `bash /usr/local/lib/pi-devbox/setup-lan-access.sh`
+in the container.
 That looks exactly like "my override is being ignored". One case still needs
 action: a file that exists but the container cannot read is left out, because
 ssh would otherwise refuse every connection. The script then prints a warning at