chore: prepare the 1.2.0 release

Version 1.2.0 (manifest "1.2"): the release adds features without
breaking changes, and 1.1.0 already exists in the changelog. The
lockfile's root version, still 1.0.0, moves with it.

Turn Unreleased into the 1.2.0 section, fold in the unheaded bullets
beneath it, add the template-limit entry, note that 1.1.0 never reached
addons.mozilla.org, and fix the stray ")" in the 1.0.0 heading. The
manifest description now covers the menu, toolbar button and shortcut.

Record in the design spec that ChatGPT auto-submits ?q= prompts again as
of 2026-10-18, and what that means for Appendix B's selection-smuggling
argument.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/superpowers/specs/2026-07-29-extension-options-design.md

@@ -96,6 +96,21 @@ send. The hypothesis that address-bar navigation might still be favoured
 (`Sec-Fetch-Site: none` being the most-trusted value) **does not hold in
 practice**.
 
+**Correction, 2026-10-18: `q` auto-submits again.**
+- **Signed out:** in headless Firefox 157, `chatgpt.com/?q=` sent the prompt
+  and ChatGPT answered with no keypress. This happened even when an unrelated
+  page navigated to the URL (`Sec-Fetch-Site: cross-site`).
+- **Maintainer's Firefox:** the same day, the maintainer reported that prompts
+  were sent without pressing Enter.
+- **A week earlier:** on 2026-10-12 the signed-out path showed a verification
+  error and the signed-in path still needed Enter
+  (`docs/toolbar-verification.md`).
+
+So this changed within a week and may differ between accounts. Treat both
+behaviours as possible. The copy rule below still applies, and the README
+already says ChatGPT decides whether a prompt is sent. Appendix B covers what
+this means for selection smuggling.
+
 No copy in the options panel, README, or AMO listing may say the query is
 *searched*, *sent*, or *asked* — only that ChatGPT opens **with the query filled
 in**. The two-keypress behaviour is an upstream ChatGPT change, not a defect in
@@ -698,7 +713,7 @@ by running commands against copies under `/tmp`; the repo itself was unmodified.
 | Parameter | Rating | Basis |
 |---|---|---|
 | `q` prefills | **Solid** | Dated 2026 sources; maintained tooling; OpenAI's own extension uses it; a live probe returned HTTP 200 with all parameters preserved. |
-| `q` auto-submits | **Refuted, and confirmed by first-hand test** | Prefill-only in every dated report since 2025-11-11. Tenable TRA-2025-22 documents OpenAI gating auto-submit on `Sec-Fetch-Site`. Reproduced 2026-07-29 in the maintainer's logged-in Firefox via this extension's own search-provider path. |
+| `q` auto-submits | **Varies; auto-submitting again as of 2026-10-18** | Prefill-only in every dated report from 2025-11-11, when Tenable TRA-2025-22 documented OpenAI gating auto-submit on `Sec-Fetch-Site`, and reproduced 2026-07-29 in the maintainer's logged-in Firefox. On 2026-10-18 it auto-submitted signed out, including after a cross-site navigation, and the maintainer reported the same in their own Firefox. See the correction under the `q` section. |
 | `model` honoured alongside `q` | **Uncertain** | An unresolved 2024-12-28 report says `q` forces GPT-4o regardless; counter-evidence exists from 2024–2025; no 2026 source positively confirms. Maintained tooling grades it experimental. |
 | Valid `model` slugs | **Uncertain** | No authoritative list; sightings rot (`gpt-4`, `o1-preview`, `gpt-4o`, `gpt-5-thinking`, `auto`, `instant`, `thinking`). |
 | `temporary-chat=true` | **Uncertain** | Community-confirmed originally; multiple reports of it not applying or reverting after the first message; OpenAI reworking the feature. |
@@ -790,6 +805,16 @@ composer until a human presses Enter. **Auto-submit deletes that checkpoint.**
 This is also why the context menu and shortcut remain safe *as long as they only
 prefill*.
 
+> **2026-10-18:** ChatGPT itself now auto-submits `?q=` prompts, at least for
+> some accounts (see the correction under the `q` section). While that holds,
+> the composer checkpoint above is gone for the context menu, toolbar button and
+> shortcut alike: hidden text in a selection can reach an answered prompt
+> without review. The extension still adds no submission of its own, and this
+> appendix's rejection stands. 1.2.0 ships with the behaviour known. Possible
+> mitigations, such as framing the default Ask prompt as data the way the preset
+> actions already do, or an option to review page-sourced text first, are open
+> follow-ups rather than part of this design.
+
 **`webNavigation.transitionType` is not a security boundary.** The signal looks
 right — a `gpt` search emits `transitionType: "generated"` with
 `transitionQualifiers: ["from_address_bar"]`, and content cannot forge those