chore(release): v1.2.1 with importlib-derived __version__

[MrCloudSec]

Description

Patch release v1.2.1 fixes the version-string mismatch introduced in v1.2.0 (bks --version reported 1.1.0 because __version__ in __init__.py was hard-coded and not bumped at release time).

Changes

• bedrock_keys_security/__init__.py: replace the hard-coded __version__ = "1.1.0" with a runtime lookup via importlib.metadata.version("bedrock-keys-security"). Single source of truth, can no longer drift from pyproject.toml.
• pyproject.toml: bump version to 1.2.1.
• CHANGELOG.md: new [1.2.1] - 2026-05-19 Fixed entry.

Verification

Local install + run:

$ pip install -e .
$ bks --version
bks, version 1.2.1 (commit 1c6dcc6)

Tests: 58 / 58 pass.

Post-merge

After tag + PyPI publish, yank 1.2.0 from PyPI so pip install bedrock-keys-security auto-resolves to 1.2.1:

pypi yank bedrock-keys-security 1.2.0 --reason "version mismatch: bks --version reported 1.1.0; fixed in 1.2.1"

(Or via the PyPI web UI.)

[ccalvani]

looks good