release(v1.12.2): pi 1.4.0, pi-studio v0.11.1, Node 24.22.1 + git-lfs 3.8.1 security

Patch release. pi 1.3.0 -> 1.4.0 (audited, notes next to ARG PI_VERSION in
Dockerfile.variant). pi-studio v0.10.2 -> v0.11.1 (-studio tags; pane echo
now defaults to Summary, see Upgrade notes). The base rebuilds because
rootfs/ changed (8ae1659), so Node v24.22.1 (8 CVEs), git-lfs v3.8.1
(4 CVEs), uv 0.13.5 and agent-browser 0.39.2 come in from latest.
BASE_REBUILD_DATE marker refreshed while the base rebuilds anyway.
check-doc-drift.sh: OK (pi-version and pi-studio named above v1.12.1).

Dockerfile.variant

@@ -317,7 +317,42 @@ ARG USER_NAME=developer
 # extension with no [Extension issues], the bridge registers its 45 tools,
 # /om:status, /om:view and the /studio commands are offered, and atelier
 # paints ACTIVITY/READY/TOOLS in both renderers (controls with -ne: none).
-ARG PI_VERSION=1.3.0
+#
+# v1.12.2: 1.3.0 -> 1.4.0 (npm latest, published 2026-10-21T22:48Z). MEASURED
+# 2026-10-22 on tor-ms22 from isolated npm prefixes for 1.3.0 and 1.4.0, with
+# the published tarballs unpacked side by side:
+#   1. NO `### Breaking Changes` section in 1.4.0. Behaviour changes, none of
+#      which reaches us: attribution headers come from pi-ai's client identity,
+#      so `before_provider_headers` handlers no longer see them, and
+#      `generateSummary()` ignores `reserveTokens`. 0 uses of either
+#      (`before_provider_headers`, `generateSummary`, `reserveTokens`) in
+#      pi-extensions, pi-fork, obsmem, pi-atelier and pi-studio. Control: the
+#      same grep finds `registerTool` in 18 files.
+#   2. pi-agent-core 1.3.0 -> 1.4.0 is NOT byte-identical this time, but every
+#      changed line in dist (4 files) is the new optional `identity` field and
+#      `DEFAULT_AGENT_IDENTITY`; 0 changed lines mention finishTurn, so obsmem's
+#      turn cap is untouched. pi-tui adds only exit-restore methods
+#      (`restoreOnExit`, `getExitRestorePrefix/Suffix`, #11170); atelier's
+#      internals TuiMainScreen / renderLayoutFrame are in the same 10 dist
+#      files. The extension loader only gains the `@earendil-works/pi-ai/models`
+#      alias (#11156). pi-mcp and pi-codemode dist are byte-identical.
+#   3. Public API: the only removed .d.ts exports are
+#      `mergeProviderAttributionHeaders` (pi-coding-agent) and `getPiUserAgent`
+#      (pi-ai). 0 consumers. All 58 runtime-imported names across pi-toolkit,
+#      pi-extensions, pi-fork, obsmem, pi-studio (0.10.2 and 0.11.1),
+#      pi-atelier, mempalace-toolkit, ~/.pi/agent/extensions and /opt/fleet-pi
+#      resolve in 1.4.0, and in 1.3.0 (control: an injected fake name is
+#      reported missing).
+#   4. engines.node is still `>=22.19.0`. Peer ranges: atelier >=0.84.0, fork
+#      >=0.75.0, obsmem and studio `*`.
+# Exercised before tagging, with a copy of tor-ms22's real ~/.pi/agent
+# (pi-studio swapped for v0.11.1): `pi -p` answers PONG, rc 0 in 10 s (1.3.0:
+# 9 s), nothing on stderr. In the TUI the [Extensions] list is the same as on
+# 1.3.0, with no [Extension issues]. The bridge registers its 45 tools, and
+# TOOLS shows 58 / 64 on both. /om:status, /om:view and the /studio commands
+# are offered, and atelier paints ACTIVITY/READY/TOOLS in both renderers
+# (control with -ne: none).
+ARG PI_VERSION=1.4.0
 ARG PI_TOOLKIT_REF=main
 ARG PI_EXTENSIONS_REF=main
 # Repo URLs default to the canonical gitea origin but are overridable so a