Release request: v0.1.2 with signed macOS PKG #143

@peterj could you cut a v0.1.2 release from main (currently 48b4df7)?

We're rolling agentdesktop out through MDM and need a release-signed macOS PKG that includes the fixes merged since v0.1.1:

• fix: surface real controller connectivity and stop discarding daemon logs #98 surface real controller connectivity and stop discarding daemon logs
• fix(discovery): inventory centrally managed MCP servers #128 inventory centrally managed MCP servers
• fix: retry transient OIDC refresh failures instead of disabling the controller #129 retry transient OIDC refresh failures instead of disabling the controller
• fix(agent): recover from an unreadable stored device identity #132 recover from an unreadable stored device identity
• fix(oidc): open the authorization page without waiting for the launcher #133 open the OIDC authorization page without waiting for the launcher

The only signed PKGs available today are the v0.1.1 run artifact and the #124 branch build (0.1.2-124). Neither has these fixes.

Asks, in order of preference:

1. Tag v0.1.2 from main, with the workspace version bumped first (see v0.1.1 binary internally reports version 0.1.0 (Cargo.toml not bumped before release) #106; Cargo.toml still says 0.1.0). Attach the macOS PKG to the release if add macOS installers to the release #124 lands in time (see Release v0.1.0 missing macOS PKG installer — only raw binaries attached #77).
2. If a full release isn't ready yet, run the Release workflow on main via workflow_dispatch with version=0.1.2-rc.1 and skip_github_release=true. A signed PKG run artifact is enough for us to start testing.

Please keep the current signing identity. The daemon's Keychain items are bound to the app's designated requirement, so a different certificate forces every enrolled device to re-enroll.

Thanks!