release: prepare 0.12.1 release notes and version bump

[Aaronontheweb]

Summary

• Updates release notes in release_notes.md for version 0.12.1
• Bumps version metadata to 0.12.1

Changes included in this release

• fix(security): expand MagicByteValidator beyond image-only allowlist (fix(security): expand MagicByteValidator beyond image-only allowlist #626)
• feat(observability): log turn_tool_call_batch as structured metric (feat(observability): log turn_tool_call_batch as structured metric #625)
• chore(ci): disable Docker publish job in release pipeline (chore(ci): disable Docker publish job in release pipeline #620)
• fix(security): gate control-plane writes, hard-deny lifecycle files (fix(security): gate control-plane writes, hard-deny lifecycle files #617)

Test plan

• Verify release notes are accurate and complete
• Confirm version bump is correct (0.12.0 -> 0.12.1)
• Merge and confirm CI passes on dev
• After merge, tag will be created and pushed to trigger release workflow