chore: bump version to 0.1.123 - #310

Bumps the package version to 0.1.123. Merging this PR cuts release v0.1.123 — the first to ship a Windows build.

Releases everything since v0.1.122: #305, #299 (Windows support), #306.

Also replaces the macOS DMG now served as latest: v0.1.122's OpenResearch.dmg and macos-app.json were overwritten on 2026-09-11 01:53 UTC by an attach run chained off a release dry run, so they no longer match the v0.1.122 tag.

Pre-merge checks

• Release dry run on the Windows branch (run 34550579194) built and verified all five targets, including x86_64-pc-windows-msvc
• ui/dist is current — rebuilt from ui/src at eaba866, all 66 files byte-identical to the committed bundle
• No new telemetry events in the range, so the production contract is unchanged
• RELEASE_DISPATCH_TOKEN is set, so the macOS DMG should auto-attach
• Hold other merges to main until the Release run publishes — release.yml tags main's tip at dispatch
• Watch the Release run. The dry run exercised only the development build; this is the first Windows build with ORX_OFFICIAL_RELEASE_BUILD=1 and a production channel check. A failure in any Windows job skips host for every platform — fix, then re-run the release-on-bump run.

Verified locally

• cargo fmt --all --check
• cargo clippy --all-targets -- -D warnings
• cargo build --locked
• cargo test --locked — 781 passed, 0 failed
• Version guard: 0.1.122 → 0.1.123 moves forward, Cargo.lock regenerated, v0.1.123 tag unclaimed

What Windows testers get

openresearch-cli-x86_64-pc-windows-msvc.zip (extract, double-click orx.exe) and openresearch-cli-installer.ps1. Both are unsigned, so SmartScreen warns on first run; see docs/windows.md.

Windows is a beta. Starting the dashboard by double-click is verified on real hardware; the demo, SSH, and cancelling a local run on Windows have not yet been exercised by a person (see #299's checklist).

🤖 Generated with Claude Code