chore: release v0.7.0

[joshuajbouw]

Big release rolling up the per-domain WIT host ABI migration (kernel-side wasi-elimination, every host call routed through audited astrid:* interfaces), wasmtime 43 → 45 (closes RUSTSEC-2026-0149), outbound TCP for capsules, the Gemini review fixups for #752, and the security audit fixes that landed since 0.6.0 was tagged.

Major themes:

• Per-domain WIT migration (feat(kernel)!: migrate to per-domain WIT host ABI #752) — replaces the bundled astrid:capsule@0.1.0 world with per-domain packages astrid:fs, astrid:ipc, astrid:net, astrid:io, astrid:kv, astrid:sys, astrid:http, astrid:approval, astrid:elicit, astrid:identity, astrid:uplink, astrid:process (all @1.0.0). Every host call routes through typed error-code variants, the wasmtime ResourceTable, audit envelopes per domain, and cancellation-token races on every blocking path. Zero wasi:* linker registration — capsules see exactly what the per-domain WIT describes and nothing more.
• Outbound TCP for capsules (feat(net): outbound TCP host fns (full std::net::TcpStream parity) #746) — net.connect-tcp + net_connect allowlist capability, SSRF airlock reused from http-request, 20-method TcpStream resource surface.
• Atomic kv_cas through KvStore::compare_and_swap (was emulated get + set; now serialized via MemoryKvStore's RwLock or a single SurrealKvStore MVCC transaction).
• O(1) quota counters on HostState (net_stream_count, subscription_count, process_count_total, process_count_by_principal) — replaces the O(N) ResourceTable walk on every accept/connect/spawn.
• ProcessHandle.wait rewritten on tokio::process::Child (was std::Child + spawn_blocking, stranded the handle on timeout — Gemini feat(kernel)!: migrate to per-domain WIT host ABI #752 finding).
• fs-mkdir strict semantics enforced (was silently create_dir_all like its fs-mkdir-all sibling — Gemini feat(kernel)!: migrate to per-domain WIT host ABI #752 finding).
• wasmtime 43 → 45.0.0 (RUSTSEC-2026-0149 path_open(TRUNCATE) FilePerms::WRITE bypass).

Checklist:

• Cargo.toml version bumped to 0.7.0 (workspace + 20 internal deps)
• CHANGELOG.md [Unreleased] rolled into [0.7.0] with consolidated sections
• cargo check --workspace passes
• cargo test --workspace passes
• cargo clippy --workspace --all-features -- -D warnings clean
• Tag v0.7.0 after merge
• Release CI builds cross-platform binaries