Require SkillSpector 2.12.0 or newer

[rng1995]

Summary

Require SkillSpector 2.12.0 or newer for Tier 1 security scanning. A valid report from an older scanner now leaves the static or optional LLM stage INCOMPLETE and shows an upgrade command instead of being accepted as complete evidence.

Update installation guidance and the changelog, cover the version boundary and newer releases, and refresh legacy test reports to the supported contract. Add a real --no-llm report captured from the prepared 2.12.0 release commit 41fca42e980d955d355b717a93a30831c26b284c.

Release dependency: merge after NVIDIA/SkillSpector#550 is released. At validation time, the public v2.12.0 tag did not yet exist; the captured report was verified against that release candidate.

Verification

• I am familiar with the Contributing Guidelines
• Added or updated focused tests
• Updated documentation for user-visible changes
• Ran make lint
• Ran make test: 6,455 passed, 18 skipped (Python 3.13, isolated locked dependencies, 8 workers)
• Ran make build: wheel and sdist built successfully
• Did not add credentials, private datasets, or proprietary benchmark content

Also passed the OSS boundary scan and fern check (0 errors; authenticated redirect checking was skipped because no Fern token was configured).

Release Impact

• No user-visible release note needed
• Updated CHANGELOG.md