Two pieces of release automation on tag push (`v*`):

  binaries job
    cargo build --release --workspace, tar.gz forkd + forkd-controller
    as forkd-<tag>-x86_64-linux.tar.gz, attach to an auto-created
    GitHub Release together with a SHA256SUMS file. Uses
    softprops/action-gh-release, generates release notes from commits
    since the previous tag.

  docker job
    Builds the controller's Dockerfile and pushes to
    ghcr.io/deeplethe/forkd-controller:<tag> and :latest.
    No extra secrets needed — relies on GITHUB_TOKEN with the
    workflow's `packages: write` permission.

Version bumped 0.1.1 → 0.1.2 in workspace Cargo.toml and Python SDK
pyproject.toml. New since 0.1.1: per-tag persistent volumes,
recipes/ directory with five pre-built parents, README ledes with
AI agent fan-out, comparison table fact-check + ✓/✗ unicode marks,
star history chart, monochrome → slate → orange-red logo iteration.

Why 0.1.2 (not 0.2.0): pragmatic — no downstream Rust crate consumers
yet, signature change on `Vm::snapshot_to` is invisible in practice.
v0.2.0 reserved for the next genuinely large surface change (pre-
warmed pool / daemon-side snapshot + volume API).

Not in scope this commit: PyPI publish, crates.io publish, multi-arch
builds. Each needs additional secrets / setup and we don't have
downstream consumers driving the need yet.