chore(release): 0.7.12

[krassx]

Releases what has been sitting on main since 0.7.11:

• feat(upload): make --artifact optional on upload build #52 — upload build without --artifact registers a build and ships no bytes. The only mode a web build can express; the JS plugin's registerBuild needs it published before it can depend on it.
• fix(npm): let npm run its 2FA prompt when reading trust state #53 — maintainer-only fix to npm/bootstrap-names.sh (npm's 2FA challenge was swallowed by $(...)). The published binary is unaffected.

Version bump in Cargo.toml / Cargo.lock, changelog dated — same shape as #51.

Before merging

• bugsee-appserver#42 should land first, or together. The CLI forwards format from the payload without validating it, and the Build schema's enum rejects "web" until feat(debug-files): scaled concurrent source-map uploads + --allow-empty #42. Releasing this first is harmless (nothing calls it with format: "web" yet) but the feature isn't usable end to end until both are in.
• chore(deps): bump zstd from 0.13.3 to 0.14.0 #38 (dependabot, zstd 0.13.3 → 0.14.0) is still open and was green. It touches every upload's compression, so it's your call whether it rides in this release or the next — merge it first if it should be in 0.7.12, and I'll add the changelog line.

🤖 Generated with Claude Code

[claude]

Code review

Pure release-bump PR: CHANGELOG entry for 0.7.12 plus the matching Cargo.toml/Cargo.lock version bump. No source files changed, so none of the load-bearing contracts (--help sync, stdout purity, exit codes, wire shapes, Cargo.toml table ordering, MSRV, daemonizing, cross-platform, network I/O, release.yml) are touched by this diff.

Findings: None.

Merge as is.