chore(release): Phase 7 close — v0.7.0 (Solution 1 + opus 4.8) (#70)

Closes Phase 7 with version bump from 0.5.1 to 0.7.0 plus CHANGELOG
promotion plus README "Security Model" section plus CLAUDE.md
release_kit overlay update.

Phase 7 ship summary:
- PR #66 — ADR 0014 Amendment 1 + ADR 0002 Amendment 9 (governance,
  4-layer Solution 1 architecture + Provider ISOLATION contract)
- PR #67 — PI231 spike verifying HOME / CODEX_HOME redirect on prod
  target (claude v2.1.152 + codex v0.133.0)
- PR #68 — Solution 1 implementation + opus 4.8 model registration
  (lib/sandbox/manager.mjs refactored; ISOLATION blocks on anthropic
  + codex; server.mjs wire-up; models-registry.json)
- PR #69 — Loader fix (lib/providers/index.mjs attaches ISOLATION
  named export onto provider default export) + test-context bypass
  for streaming singleflight cache test compatibility

Phase 7 verification (PI231 prod E2E with claude v2.1.154 +
codex v0.133.0 + OLP_SANDBOX_DISABLED=1):
- Real ~/.claude.json mtime unchanged across requests
- Real ~/.codex/auth.json mtime unchanged
- find ~/.claude.json ~/.claude ~/.codex -newer marker returns EMPTY
- claude-sonnet-4-6, claude-opus-4-8, gpt-5.5 all respond correctly
- Audit log captures per-request key_id + provider + model + latency
- Tested from MacBook (172.16.2.29) and PI230 (172.16.2.230) clients

Pre-Phase-7-close upgrades:
- PI231 claude CLI: 2.1.152 to 2.1.154
- Mac mini OpenClaw: 2026.5.22 to 2026.5.27 (via openclaw update)
- PI230 Hermes: 0.14.0 to 0.15.1 (pip + systemctl restart)

File changes:
- package.json: 0.5.1 to 0.7.0
- CHANGELOG.md: Unreleased promoted to v0.7.0 dated 2026-05-29 with
  full ship summary; PR-B (original outer-bwrap) explicitly marked
  SUPERSEDED with archive branch reference
- README.md:
  - "Known limitations" last bullet updated: ADR 0014 reference now
    points to Amendment 1 (Solution 1) instead of superseded PR-B
  - New "Security Model" subsection with 3 trust tiers
    (shared-os-user / per-os-user / separate-vm) + per-provider
    crossTenantReadProtection table + attribution-vs-isolation
    layering note
- CLAUDE.md release_kit overlay:
  - current_phase: "Phase 6" to "Phase 7 closed at v0.7.0
    (2026-05-29); Phase 8 not yet scoped"
  - current_pre_release_identifier: 0.6.0-phase6 to 0.7.0

Test status: 813/813 pass; Suite 44 (PI231 Layer 3 E2E placeholder)
documented as deferred (load-bearing isolation negative test now
delivered by the PI231 prod E2E in the Phase 7 verification above).

Tag: v0.7.0 pushed post-merge to trigger
.github/workflows/release.yml per release_kit overlay.

Co-authored-by: dtzp555 <dtzp555@gmail.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

CLAUDE.md

@@ -135,7 +135,7 @@ release_kit:
     # This overlay is the authoritative source. If Iron Rule 5 appears to be silently
     # violated (no version bump after many D-day pushes), check this section first
     # before filing a compliance finding.
-    current_phase: Phase 6
-    current_pre_release_identifier: "0.6.0-phase6"
+    current_phase: Phase 7 closed at v0.7.0 (2026-05-29); Phase 8 not yet scoped
+    current_pre_release_identifier: "0.7.0"
     phase_close_trigger: explicit maintainer action (not automated)
 ```