release: 1.2.0

[fheikens]

v1.2.0 — GHCR distribution + verifiable releases

Class: feature. No change to the bundled pgagroal version (2.1.0).

• GHCR distribution — image now published to ghcr.io/elevarq/pgagroal alongside Docker Hub (signed + SBOM + SLSA provenance on both).
• Verifiable releases — release notes document the full cosign signature + attestation verification + supply-chain guide.
• Community-health parity — CoC, GOVERNANCE, SECURITY contact, CODEOWNERS fix, README CI badge, YAML issue forms.
• CI — setup-helm 4→5, trivy-action 0.35→0.36.

prepare-release.sh --check-only: all version-consistency + Gate F (F3/F4/F7/F8/F9) checks pass. On merge, tag v1.2.0 triggers the publish pipeline (build → test → security → sign → push Docker Hub + GHCR → GitHub release).

Bundles the work from #35, #30, #28, #34, #24, #25.