ci: point the --locked-mode drift guard at the new Microsoft.OpenApi pin

#576's group bump moved Microsoft.OpenApi 2.12.0 -> 2.12.2, so the drift
guard's hard-coded sed source (2.12.0) no longer matched and the guard failed
with 'drift-guard perturbation target not found'. Update the perturbation to
2.12.2 -> 2.12.1 and the grep target to 2.12.1.

Verified locally: the perturbation lands and the --locked-mode restore fails
with NU1004 (stale lock), which is exactly what the guard asserts.

Author: mforcepr

.github/workflows/ci.yml

@@ -288,11 +288,11 @@ jobs:
           work="$(mktemp -d)"
           git archive HEAD | tar -x -C "$work"
           cd "$work"
-          sed -i 's#<PackageReference Include="Microsoft.OpenApi" Version="2.12.0" #<PackageReference Include="Microsoft.OpenApi" Version="2.11.0" #' \
+          sed -i 's#<PackageReference Include="Microsoft.OpenApi" Version="2.12.2" #<PackageReference Include="Microsoft.OpenApi" Version="2.12.1" #' \
             src/Cluckwork.Api/Cluckwork.Api.csproj
           # Fail loudly (don't silently pass) if the pin used as the perturbation
           # target has since moved — the guard must be kept pointing at a real pin.
-          grep -q '<PackageReference Include="Microsoft.OpenApi" Version="2.11.0" ' \
+          grep -q '<PackageReference Include="Microsoft.OpenApi" Version="2.12.1" ' \
             src/Cluckwork.Api/Cluckwork.Api.csproj \
             || { echo "::error::drift-guard perturbation target not found; update the Microsoft.OpenApi version it edits"; exit 1; }
           if docker build --target build -f src/Cluckwork.Api/Dockerfile -t cluckwork-lockdrift:ci . ; then