[TAIPANBOX]

Release prep for idryx 1.2.1: docs/releases/v1.2.1.md only. No code change in this PR.

What and why

• The change being released is fix(ingest): name the event types and sources no detector reads, not unknown #103: the stderr line for an ingest names event types and sources no detector reads, and stops calling a registered type "unknown". The ingest path, knownTypes and events.consumed are unchanged.
• Also on main since 1.2.0, not behaviour: 4403c42 (the teeth case for "no scenario" now removes every feature file) and dfe360e (CI action pins in release.yml and scorecard.yml).
• Patch, not minor. Nothing is read, emitted or refused differently and no name in compat/1.0.json moved; the stderr wording is not in the frozen surface. The README badge (381) was already updated by fix(ingest): name the event types and sources no detector reads, not unknown #103.

Tier: T0 (release notes; no code, no new test). The red-first step does not apply here; #103 carries its own tests, and I did not re-run them against the unfixed code. Coverage is not reported because no code changed.

Gates run locally

• gofmt -l .: empty
• go vet ./...: ok
• staticcheck ./... (GOTOOLCHAIN=go1.27.1, as CI does): run with GOOS=linux it is clean. Run on darwin it reports const procPidInitIno is unused in internal/ebpfcapture/self.go, because the only use is in the linux-only capture_linux.go. That is a darwin-only false positive, present on main as well, and CI runs on Linux.
• go test -race -count=1 ./...: all 20 packages with tests ok
• gosec -quiet ./...: exit 0 (gosec v2.29.0 is the CI pin; the installed binary reports Scanner from the same family, not re-pinned here)
• govulncheck ./...: No vulnerabilities found
• scripts/compat-surface.sh: 29 frozen names present, COMPATIBILITY.md is their rendering
• scripts/detectors-complete.sh: 27 detectors, each registered and tested
• scripts/diagrams-match-detectors.sh: exit 0
• scripts/features-are-bound.sh: 17 scenarios, 17 bindings, 0 broken
• scripts/ebpf-optional.sh: exit 0
• scripts/readme-numbers.sh: 381 test functions, badge says 381
• scripts/reproducible-build.sh: reproducible, digest 3e7339c5457e2090185758b4a7bedc318b7448d667602819307db8a6c300a4fa
• scripts/gates-have-teeth.sh: 24 cases, every gate fails on its own fault and passes on a non-fault; tree clean afterwards
• preflight.sh pr: every check ok

Not proven

• The release and image jobs run only on the tag push.
• The eBPF sensor's source is unchanged since 1.2.0. object-matches-its-source.sh, the BPF teeth cases and the integration job run only in CI's Linux jobs and were not run here.
• No operator has read the new stderr wording on a live box.

🤖 Generated with Claude Code