Release 2.7.0

[ianktoo]

Release 2.7.0: a minor release, because it adds a keyboard URL review, a language choice and a discovery scope choice to the interactive wizard, and fixes a globally saved API key not being found. No breaking changes to commands, recipes or file formats. One behaviour change in the review's typed commands: row numbers (x 3-8, i 3) now refer to the whole list, not only the current page.

Version bump

• pyproject.toml and uv.lock: 2.6.0 to 2.7.0
• CITATION.cff: version: 2.7.0
• README: current-release line; changelog link points at 2.7.0
• CHANGELOG: new [2.7.0] - 2026-09-24 section with a summary, Added, Changed and Fixed

What 2.7.0 contains (37fc86b, branch feat/url-review-scope)

Keyboard URL review (cli/url_review.py)

• Full-screen list: arrow keys (or j/k) move, Space ticks or unticks and moves down, Left/Right or PgUp/PgDn turn pages, Home/End jump, a ticks or unticks everything shown, / filters as you type, i shows details, ? help, Enter finishes, Esc/q goes back.
• The pager shows arrows (dimmed when there is nothing that way); the page size follows the terminal height.
• The typed commands of earlier versions still work after :.

Language choice

• On a site with pages in several languages (first path segment such as /es/ or /pt-br/, or a lang/language/locale query parameter), the review first asks which language to tick. The others stay listed, unticked. l cycles the list through one language at a time.
• Detection moves from app.py to url_review.py and reuses the recipe's locale list, so it no longer mistakes any two-letter segment (for example /us/) for a language.

Discovery scope

• For seed URLs that are not a sitemap, the wizard asks: just these pages (discovery and the review are skipped), deep link search (crawl from the seeds without reading the sitemap), or the whole site (previous behaviour).
• PipelineContext.discovery_scope carries the choice; it is saved in the session config, so resume repeats it instead of crawling the site. Page scope ignores "skip already scraped".
• Recipes, headless runs and MCP keep the default (site).

Fix: globally saved API key not found

• "Save API key globally" stores the key in the OS keychain, but startup read only prefs.json, and only when the folder had no .env, which dataforge config always creates. So the run still asked for the key.
• preflight.apply_saved_config now loads saved keys, provider and model whether or not .env exists. Precedence: shell environment, then .env, then global config. Keys found in .env are exported to the environment too.
• The credentials check looks in the keychain before prompting, and a provider changed from the Settings menu updates the loaded settings without a restart.

Tests and docs

• New tests/test_scope_and_saved_keys.py (scope behaviour of the explorer, key precedence, no prompt when a saved key exists). The review tests now drive the screen with real key presses through a pipe input.
• docs/TECHNICAL.tex discovery section describes the scope choice and the language step.
• Locally on Windows: full suite passes; a clean install of the built 2.7.0 wheel passes scripts/smoke_test.py --mcp --e2e (24/24).

This PR also carries a2eb374 (ignore the local .dataforge session index), which was on local master.

After merge

Tag v2.7.0 on master. The release workflows run the full suite, publish to PyPI, build and smoke-test the standalone binaries, and create the GitHub release; release-smoke.yml then tests the PyPI release on every OS and Python.