chore[skiplog|notask]: backmerge release-cli-0.12.0 — version bump, sdk dep range, changelog

[simon-iribarren]

🎯 What problem does this PR solve?

• Lands the release metadata for @qvac/cli@0.12.0 on main, per gitflow.md "Keep main aligned", so future development and the next changelog base see the shipped version.
• Without it, main keeps @qvac/cli at 0.11.0 with a stale @qvac/sdk ^0.17.0 range that predates the @qvac/sdk/schemas subpath qvac configure needs.

📝 How does it solve it?

Hand-crafted backmerge — not a cherry-pick of the release PR. No functional changes; tagged [skiplog] so it does not appear in future changelogs.

• packages/cli/package.json — version 0.11.0 → 0.12.0, @qvac/sdk ^0.17.0 → ^0.18.1
• packages/cli/changelog/0.12.0/ — CHANGELOG.md, CHANGELOG_LLM.md, api.md
• packages/cli/CHANGELOG.md — aggregate rebuilt

Companion release PR: #3990

🧪 How was it tested?

A hand-crafted backmerge is required here, rather than the usual cherry-pick of the release commit.

The release PR carries two feature commits — qvac configure (#3953) and qvac doctor --deep (#3492) — because both merged into main after release-cli-0.12.0 was cut, and the release line is governed by a pull_request ruleset that forbids fast-forwarding it. Those commits are already on main. Cherry-picking the release commit here would therefore try to re-land Lauri's and the doctor work on main, and would also drag @inquirer/prompts in as if this PR had added it.

So this branch was rebuilt directly on the current main tip with a single metadata commit:

• git diff --stat upstream/main..HEAD shows exactly five files — the four changelog/aggregate files plus package.json. No source files.
• The package.json delta is only the two lines: version and the @qvac/sdk range. @inquirer/prompts 8.5.2 is left untouched, since it reached main with QVAC-23391 feat: add qvac configure interactive config generator #3953.

Dependency divergence check — nothing regresses:

Dependency	main before	this PR	Note
@qvac/sdk	^0.17.0	^0.18.1	moves forward; 0.18.1 is the first SDK with the ./schemas export (#4000)
@inquirer/prompts	8.5.2	8.5.2	untouched
all other deps	unchanged	unchanged	—

Precedent for the hand-crafted shape: the @qvac/cli 0.11.0 backmerge (#3835-era flow) and the @qvac/sdk 0.18.0 backmerge (#3961).

[github-actions]

License compliance — clean

No new dependency license findings in this PR.

Warn-only (shadow) mode — this check does not block merges yet.

Updated automatically by the canonical license compliance workflow.

NOTICE presence (advisory)

Missing NOTICE (advisory, does not block):

• ./.github/actions/release-merge-guard
• ./docs/website
• ./packages/ggml-coload-smoke
• ./packages/fabric/test/integration
• ./packages/inference-addon-cpp/mobile
• ./packages/sdk/e2e
• ./packages/llm-llamacpp/benchmarks/performance
• ./packages/llm-llamacpp/benchmarks/server
• ./packages/vla-ggml/sim/server
• ./packages/embed-llamacpp/benchmarks/performance
• ./packages/embed-llamacpp/benchmarks/server
• ./packages/asr-ggml/benchmarks/server

[github-actions]

Review Status

Current Status: ❌ PENDING
Approvals so far: none

Pending reviews: Needs 1 Management or Team Lead, and 1 more from Management, Team Lead, or Member.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​qvac/​sdk@​0.18.1

View full report