v1.2.0: watch v2 (pruned+debounced polling), rotor doctor, watch UI stats, security hardening

Transformer-plugin hardening: embedded Node sidecar (works outside the repo), project-resolved typescript (shared instance with plugins), stdout-protocol protection, warm sidecar sessions across builds and watch rebuilds. Validated against rbxts-transformer-flamework@1.3.2 and rbxts-transform-env@3.0.0 on Windows and Linux.

v1.0.2: publish CLI binaries (release workflow now installs bun + fixtures so tests pass and GoReleaser runs)