release: 0.7.0

[vyncint]

The production-readiness release, and the one that finally ships #133.

That fix has been on main since 2026-09-10 — twelve days — unreleased. Before it, a cluster- or grid-wide barrier under a guard that is only block-uniform produced exit 0, no findings, zero opaque: the tool said the kernel was clean. Meanwhile README.md already said "since 0.7.0" in two places, and every crate sets readme = "../../README.md", so that text was the crates.io front page of all seven crates at 0.6.1 — describing behaviour no published version had.

What else is in it

#150	the four artifact roots and ReadError are #[non_exhaustive], with the split decided by measurement and the rule written into CONTRIBUTING §8
#152	--cc takes sm_86 and 86, which launchbound already accepted and passed straight through to this parser
#145 #146	releases carry per-platform archives with checksums, and v0 is a real tag to pin instead of @main
#144 #147 #148 #149	every action pinned to a SHA, every job capped, credentials not persisted, and a zizmor job that audits online — which is the half a local run cannot do
#151	the driver forbids unsafe_code, the one crate that did not
#140	the conformance pin moves to b0f961df, and the published precision table improves with it: wrapbar 71→76% default and 93→98% strict, precision still 1.000
#154	Windows is gated, which found three bugs — a panic in learn, a build script that refused a correct toolchain, and three suites clearing an environment list written on Linux

Release mechanics

• version bumped in the workspace manifest and the five crates that pin siblings; cargo check --workspace refreshed Cargo.lock
• conformance/extractor has its own lockfile and its own cargo update --workspace (the step 0.6.1 got wrong by naming crates instead of using --workspace)
• the four witness fixtures are re-recorded and restamped to 0.7.0, and the three lesson copies refreshed — check-schemas.sh and record-fixtures.sh --check are green
• README.md's Status section now says which of the two hardware sessions has run. Session ci: make publishing resumable across rate limits #2 still has not, and it is the only external check on the accuracy claims, so it is named rather than left inside "still planned" (Hardware session #2 has never run — the only external check on the accuracy claims #153)

The gate

cargo semver-checks runs as major here, because CHANGELOG.md carries a ### Breaking heading — which is the mechanism, not a workaround: the label is invisible on a push, and the changelog is the document this release is cut from.

Closes #143