release: prepare v0.12.4 (#1063)

- Bump workspace version from 0.12.3 to 0.12.4
- Update all internal crate dependency versions in workspace manifest
- Finalize CHANGELOG.md with v0.12.4 release section
- Update insta snapshots for new version string
- Refresh README: native file tools, DiagnosticsExecutor, ToolFilter, permission gate hardening
- Refresh docs: tools.md, acp.md, concepts/tools.md, architecture/crates.md, security.md, changelog.md

Author: bug-ops

CHANGELOG.md

@@ -6,6 +6,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.12.4] - 2026-03-01
+
 ### Added
 
 - `zeph ingest <path>` CLI subcommand: recursively ingests `.txt`, `.md`, `.pdf` files into Qdrant `zeph_documents` collection via `DocumentPipeline` (#1028)
@@ -1513,7 +1515,8 @@ let agent = Agent::new(provider, channel, &skills_prompt, executor);
 - Agent calls channel.send_typing() before each LLM request
 - Agent::run() uses tokio::select! to race channel messages against shutdown signal
 
-[Unreleased]: https://github.com/bug-ops/zeph/compare/v0.12.3...HEAD
+[Unreleased]: https://github.com/bug-ops/zeph/compare/v0.12.4...HEAD
+[0.12.4]: https://github.com/bug-ops/zeph/compare/v0.12.3...v0.12.4
 [0.12.3]: https://github.com/bug-ops/zeph/compare/v0.12.2...v0.12.3
 [0.12.2]: https://github.com/bug-ops/zeph/compare/v0.12.1...v0.12.2
 [0.12.1]: https://github.com/bug-ops/zeph/compare/v0.12.0...v0.12.1