Release v0.1.2

docs/RELEASE_DEPENDENCIES.md

@@ -48,10 +48,17 @@ PATH=/home/zemion/.nvm/versions/node/v22.22.3/bin:$PATH /home/zemion/.nvm/versio
 
 The module repositories include root-level npm package manifests so git installs can resolve `@govoplan/files-webui`, `@govoplan/mail-webui`, and `@govoplan/campaign-webui` from repository roots even though their source lives below `webui/src`.
 
+### Release lockfile strategy
+
+The supported release composition currently is the full Multi Seal Mail product: core plus files, mail, and campaign. Keep one committed full-product release lockfile at `webui/package-lock.release.json`, generated from `webui/package.release.json` in a clean release workspace. Development `package-lock.json` may continue to point at local `file:` dependencies.
+
+Frontend module permutations are regression-tested through `GOVOPLAN_WEBUI_MODULE_PACKAGES` and temporary build output, not through committed lockfiles for every possible combination. If a smaller composition becomes a separately shipped product, add an explicit release manifest and lockfile pair for that product, for example `package.release.files-mail.json` and `package-lock.release.files-mail.json`, generated in a clean release workspace from tagged git dependencies.
+
 ## Release Checklist
 
 - Keep Python package versions, WebUI package versions, and git tags aligned.
 - Tag core, files, mail, and campaign repositories together.
 - Update `requirements-release.txt` and `webui/package.release.json` when the release tag changes.
-- Generate release lockfiles from release manifests in a clean build workspace.
+- Generate the committed full-product release lockfile from `package.release.json` in a clean build workspace.
+- Add separate release manifest/lockfile pairs only for module compositions that are shipped as their own products.
 - Do not commit local sibling paths into release manifests.