chore(release): v0.12.8

[ralyodio]

Ships the SSRF guard from #207: a request whose destination host is a literal is no longer reported as SSRF.

The CI gate installs @profullstack/threatcrush@latest, so profullstack/cli-tools#103 stays red on two high-severity alerts until this is on npm.

Version bump only; the tag v0.12.8 follows on merge and triggers the npm publish.

[github-actions]

ThreatCrush Security Scan

12 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 6 | LOW: 5

Severity	Rule	Location
HIGH	secret-aws-access-key	prd/0003-detect-hardcoded-secrets-before-they-are-committed-or-served.md:126
MEDIUM	js-open-redirect	apps/web/src/app/auth/login/page.tsx:50
MEDIUM	js-unescaped-html-sink	apps/web/src/app/hire/page.tsx:104
MEDIUM	js-unescaped-html-sink	apps/web/src/app/hire/page.tsx:108
MEDIUM	js-open-redirect	apps/web/src/components/funding/FundingClient.tsx:97
MEDIUM	js-unescaped-html-sink	apps/web/src/components/GuideReader.tsx:265
MEDIUM	js-uninitialized-buffer	packages/scan/src/node-rules.ts:456
LOW	secret-generic-credential	PRD.md:269
LOW	tls-verification-disabled	prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:121
LOW	tls-verification-disabled	prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:122
LOW	sh-remote-script-execution	scripts/smoke-test.sh:47
LOW	secret-aws-access-key	scripts/smoke-test.sh:112

Snippets are redacted; ThreatCrush never prints matched credential material.