Release 0.12.0 repo context integrity

[fqjony]

Improves dev.kit repo evidence quality for humans, agents, scripts, and CI/CD. Generated context is now more portable, source-aware, and explicit about which dev.kit version produced it.

Outcomes

• .rabbit/context.yaml can identify its generator version and source refs: homepage, repository, npm package, and installation guide.
• Generated context is guarded against machine-local absolute paths and temporary context evidence before it is written.
• Repo-owned docs now define what dev.kit reads, emits, and must not own, plus the expected output shapes for downstream consumers.
• Timeout cleanup is more reliable for guarded commands while keeping timeout protection enabled.

Changes

• Add source metadata and portability validation for generated .rabbit/context.yaml.
• Add docs/context-contract.md and docs/references/output-schemas.md.
• Exclude temporary context files from repo evidence.
• Harden process-group timeout cleanup with PID fallback.
• Bump release metadata to @udx/dev-kit@0.12.0.

Compatibility

• Command surface is unchanged: dev.kit, dev.kit env, dev.kit repo.
• .rabbit/context.yaml remains generated repo evidence, not hand-authored guidance.
• dev.kit repo --json may still expose local workspace paths because it describes the current machine; generated .rabbit/context.yaml is portability-guarded.

Verification

• make test
• bash tests/suite.sh --only repo-contract
• Smoke-tested against two representative private repos: stale 0.11.0 context was detected, regeneration produced 0.12.0 metadata/source refs, and no local path or temp context leaks were found.

Rollout

• After release, install/update with npm install -g @udx/dev-kit@latest.
• Run dev.kit repo in active repos to refresh .rabbit/context.yaml.

[Copilot]

Pull request overview

Prepares the dev.kit 0.12.0 release by strengthening the repo context contract’s integrity/portability, documenting stable output shapes, and hardening guarded timeout cleanup to better prevent runaway processes.

Changes:

• Bump release/version metadata to 0.12.0 and update changes.md.
• Extend .rabbit/context.yaml generator metadata with stable source references and enforce portability validation before writing.
• Add/expand repo-owned documentation for the context contract and JSON/output schema shapes; adjust guarded timeout cleanup behavior and related tests.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/suite.sh	Adds assertions for excluding temp context files from evidence and validates new generator source refs + portability rules; expands guarded timeout tests.
README.md	Links new context contract doc and output schema reference doc.
package.json	Bumps package version to 0.12.0.
package-lock.json	Updates lockfile version fields to 0.12.0.
lib/modules/repo_scaffold.sh	Excludes temp context artifacts from evidence; writes context via tmp file + validates portability; adds generator sources metadata.
lib/modules/output.sh	Updates guarded runner to better terminate descendants/process groups on hard timeout; introduces a PID-list signaling helper.
docs/references/README.md	Updates reference-doc scope to include output schemas.
docs/references/output-schemas.md	Adds stable reference documentation for JSON outputs and .rabbit/context.yaml section shapes.
docs/context-contract.md	Adds repo-owned contract doc describing what dev.kit reads/emits and portability/integrity rules.
changes.md	Adds 0.12.0 changelog entries aligned with the PR scope.
.rabbit/context.yaml	Regenerates context artifact with updated generator metadata and doc refs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.