chore(release): prepare v0.7.0

[DeliciousBuding]

What

Prepares the first release since v0.6.1 (2026-08-12) — 590 commits, 56 features, 229 fixes, zero breaking changes.

• app/desktop/package.json, src-tauri/tauri.conf.json, src-tauri/Cargo.toml, src-tauri/Cargo.lock: 0.6.1 → 0.7.0 (the release tag guard requires the tag to equal the desktop version).
• CHANGELOG.md: longform v0.7.0 entry — breaking changes (none), release scope by theme, and upgrade notes.

Why 0.7.0

Minor bump: no BREAKING commits since v0.6.1, no manual migration, but substantial new surface — design-system replacement (Tailwind v4 + shadcn), workbench UX (split panes, goals, task board, deep links, dispatch queue, checkpoints), reliability/security (WS resync, JWT key rotation, audit chain, OIDC error SSOT), desktop relay + self-hosted fonts.

Release mechanics (for the follow-up)

1. Merge this PR.
2. Maintainer records the security risk review for the tag: repo variable RELEASE_RISK_REVIEWED=v0.7.0 (the gate blocks otherwise — by design, it is not auto-approved).
3. git tag v0.7.0 && git push origin v0.7.0 → release.yml builds desktop artifacts and images. RELEASE_UNSIGNED_OK=true is already set, so the unsigned Windows path is used (SmartScreen warning expected, updater metadata self-signed).

Verification

• verify-doc-ssot.py ok; git diff --check clean.
• No code changes in this PR, so the app test matrix is unchanged; desktop version consistency is enforced by the release tag guard itself.