Prepare v0.7.0 notes and retire completed roadmaps

docs/releases/v0.7.0.md

@@ -0,0 +1,106 @@
+# ReleaseKit v0.7.0
+
+## Summary
+
+ReleaseKit improves source-publication integrity, cancellation, credential-safe
+diagnostics, partial-result reporting, and temporary-file cleanup. It also bounds
+retained Go failure diagnostics and remote attachment comparison work while
+preserving the existing public facades and configuration formats.
+
+## Publication and Git operations
+
+- Exact tag pushes disable submodule recursion, correcting inherited
+  `push.recurseSubmodules=only` settings that could report success without
+  publishing the release tag.
+- ReleaseKit-owned Git inspection and preparation use original objects when
+  replacement refs exist. Committed module identity, release notes, validation
+  inputs, and build source eligibility use that consistent view. Ordinary dirty
+  builds remain supported, with their source eligibility reported separately.
+- A verified local tag object remains available in `PublicationResult.TagObject`
+  when later inspection fails. Errors identify a possibly retained local ref
+  when its object ID could not be established. Failed verification stops before
+  a push.
+- HTTP(S) userinfo is masked in owned Git diagnostics and CLI output, including
+  literal apostrophes in credentials and failed CI checkout preparation. Native
+  Git authentication, exact endpoint comparisons, and the raw captured
+  `PublicationResult.Endpoint` value retain their existing behavior.
+- Child environment overlays preserve the working-directory-derived `PWD` on
+  POSIX systems. Native Git hooks now receive the expected directory environment
+  when ReleaseKit is invoked from another checkout or module subdirectory.
+
+## Cancellation and diagnostic retention
+
+- Buffered subprocess output has bounded I/O teardown after cancellation or
+  child exit, including when descendants retain inherited output descriptors.
+  Piped Git-reader cancellation closes owned pipes and joins child cleanup.
+  Cancellation remains recognizable through `errors.Is`; ordinary execution
+  failures preserve their underlying causes.
+- A queued blob read rechecks cancellation after acquiring the reader mutex,
+  preserving a healthy batch session for later reads.
+- Status-only Go commands and dependency preparation retain a 1 MiB diagnostic
+  tail. Failed commands identify omitted earlier output. Existing streaming
+  output continues to be forwarded in full, and commands requiring returned
+  output keep their complete capture.
+
+## Builds and hosted delivery
+
+- Completed build artifacts are reported only after hashing succeeds. A hashing
+  failure identifies the affected output and preserves earlier completed
+  artifacts and their digests.
+- Temporary allocation and cleanup failures retain their paths and underlying
+  causes, including candidate builds, native version checks, delivery builds,
+  tag-message files, and build receipts.
+- A managed-build cleanup failure after confirmed hosted delivery returns an
+  error alongside `DeliveryComplete` and the confirmed asset observations. The
+  CLI reports completed remote work and the local cleanup failure, returning
+  operational status 1.
+- Gitea attachment downloads follow at most ten redirects, retaining cycle
+  detection and per-origin authorization handling. Limit exhaustion is
+  unverifiable content.
+- Remote attachment comparison reads at most the locally verified expected size
+  plus one byte. Shorter or longer content conflicts; equal-length content still
+  requires the expected digest. Read, close, and cancellation errors remain
+  inspection failures, with existing attempted-write reconciliation preserved.
+
+Shared Git observations, validation sequencing, artifact declaration matching,
+and CLI workflows were consolidated internally. Consumer-facing types continue
+to belong to the root `releasekit` and runtime `buildinfo` facades.
+
+## Compatibility and upgrade guidance
+
+The module identifier remains `go.maximumdirect.net/releasekit`, and the Go
+consumer minimum remains 1.26.0. Existing v0.6.0 API calls, profile fields, and
+build receipt formats remain supported. This minor release changes operational
+behavior through the diagnostic and redirect budgets and cleanup-error reporting
+described above.
+
+When adopting v0.7.0:
+
+1. Update library and CLI dependencies to v0.7.0 using the existing import paths
+   and profiles.
+2. Handle a delivery error together with `DeliveryResult.State`. For
+   `DeliveryComplete`, address the reported local cleanup path; the confirmed
+   hosted delivery is already complete. Continue to resolve partial, conflicting,
+   and unknown outcomes through their existing recovery guidance.
+3. Retain candidate validation's streamed `Output` when complete test diagnostics
+   are needed. Status-only failure text now contains the retained tail and an
+   omission notice when applicable.
+4. When using Git replacement refs, expect release evidence to be evaluated
+   against original committed objects. A build of dirty or replacement-derived
+   working content can succeed while remaining ineligible for binary delivery.
+5. Inspect the reported local tag ref after a tag-creation or verification
+   failure, including when `TagObject` is empty. Continue to treat the raw
+   `PublicationResult.Endpoint` as sensitive when handling it in application
+   output or logs.
+
+See the [publication guide](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/docs/consumers/publish.md),
+[build guide](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/docs/consumers/build.md),
+[delivery guide](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/docs/consumers/delivery.md),
+[CLI contract](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/docs/cli.md),
+and [Gitea integration guide](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/docs/integrations/gitea.md)
+for current behavior. Source publication and hosted delivery retain their
+separate outcomes under the [maintainer procedure](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/docs/release.md).
+
+[COPYRIGHT](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/COPYRIGHT) |
+[LICENSE](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/LICENSE) |
+[ATTRIBUTION](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/docs/oss/attribution.md)