[Zburgers]

Complete v1.2.6 under protected main

• Fix the Windows candidate step to use Bash explicitly; PowerShell expanded the version to an empty value.
• Commit synchronized 1.2.6 sources in this release PR. The version preparer now accepts an already prepared version without changing its contents.
• Make publication tag the tested merged source without pushing source commits to main, so required PRs and CI can be enforced with no bot bypass.
• Verify prepared versions in release PR CI and reject source modifications in the final tag job.
• Update release agent instructions and regression assertions.

The previous candidate run stopped before tagging. The existing v1.2.5 tag remains untouched. Main protection is now active and requires the GitHub Actions Validate check against the current base.

Local release integrity checks and actionlint passed. GitHub CI and the complete native release pipeline must pass before publication.