v2.1.2

Bug-fix release, found by the first tag-push data release on the platform.

Fixes

• athena:GetWorkGroup AccessDenied in CodeBuild — awswrangler defaults to the primary workgroup, which the platform's workgroup-scoped roles deny. AthenaConfig gains an optional workgroup, and g3dt release write runs every query in the env's SSM-published workgroup.
• Model→database search scoped to the env — find_db_for_model no longer scans every Glue database in the account: g3dt release write restricts it to the env's own silver/gold DBs (from SSM), making release rows deterministic in shared accounts.

Full Changelog: v2.1.1...v2.1.2