chore(release): prepare @commandlayer/agent-sdk 1.2.0 readiness

[GsCommand]

Motivation

• Align the SDK with the canonical @commandlayer/runtime-core receipt shape (metadata.proof.*) and prepare for an npm release at 1.2.0 after runtime-core alignment.
• Reduce published surface area and make ESM + type entrypoints explicit for downstream consumers.

Description

• Bump package version from 1.1.0 to 1.2.0 in package.json.
• Add an explicit exports map at the package root exposing types: ./dist/src/index.d.ts and import: ./dist/src/index.js while keeping existing main/types fields for compatibility.
• Tighten the npm files allowlist to dist/src, README.md, and LICENSE and remove dist/examples from the published files to avoid shipping non-essential example artifacts.
• Add a 1.2.0 entry to CHANGELOG.md documenting canonical runtime-core receipts, metadata.proof usage, signing delegation to runtime-core, test verification note, and build fixes.
• Add RELEASE_CHECKLIST.md with the release steps to run locally (install/build/test/pack/publish/tag).

Testing

• Ran npm install which failed with a 403 Forbidden fetching @commandlayer/runtime-core, blocking dependency installation.
• Ran npm run build which failed due to missing dependencies/type declarations after the install failure (TypeScript errors referencing @commandlayer/runtime-core, ajv, @types/node, etc.).
• Ran npm test which was blocked by the build failure.
• Ran npm pack --dry-run which succeeded and produced a tarball that includes dist/src/*.js, dist/src/*.d.ts, README.md, LICENSE, and package.json, but did not include dist/src/schemas.trust-*.json in this environment indicating the built schema JSON files were not present in dist/src at pack time.

---

Codex Task

[GsCommand]

Local validation on Windows confirms the release-packaging gate is now clean for this PR branch:

• npm install passed
• npm run build passed
• ls dist/src | grep schemas showed:
  • schemas.trust-receipt-v1.json
  • schemas.trust-request-v1.json
• npm test passed: 17 passed, 0 failed
• npm pack --dry-run included both schema JSON assets in the tarball:
  • dist/src/schemas.trust-receipt-v1.json
  • dist/src/schemas.trust-request-v1.json

Pack summary:

• package: @commandlayer/agent-sdk@1.2.0
• tarball: commandlayer-agent-sdk-1.2.0.tgz
• total files: 15
• schemas included: yes

This resolves the earlier pack concern from the Codex/container environment. The PR is safe to merge from a packaging standpoint.