v2.7.0

feat: idempotency keys on creation tools — safe agent retries

An optional idempotencyKey on the six creation tools lets an agent
retry a call whose response was lost on its side (harness timeout,
session restart, retry loop): a retried call with an already-succeeded
key returns the original result, marked idempotentReplay: true, with
zero write requests.

- journal: one file per instance profile (idempotency.json, 0600,
  atomic temp+rename writes, TTL 7 days — LEANTIME_MCP_IDEMPOTENCY_TTL_DAYS,
  0 disables expiry — capped at 10k live entries with an actionable
  error); survives process restarts; corrupt files read as empty rather
  than breaking mutations
- scoping: (instance, tool, key) — cross-tool reuse is refused with an
  actionable error instead of a false hit; failed mutations do not
  consume their key; dry runs ignore keys entirely (and consume nothing)
- gate placement: replay short-circuits before any API call, including
  validation reads — a replay costs zero requests
- honest scope (in the CHANGELOG and the module doc): keys cover
  agent-driven retries, NOT Ambiguous 5xx outcomes — a lost server
  response leaves nothing to journal, those still instruct verify-first
- client: with_idempotency_dir() pins the journal base; the serve
  command resolves it from the active instance profile (keyring root
  fallback when running on pure env credentials)

Also in this release (separate commit): CI contract tests against
Leantime :latest for API drift detection.

Tests: 5 unit (validation bounds, round-trip hit/miss/mismatch, TTL,
corrupt-file recovery, on-disk parseability) + 5 integration via
mockito (replay = exactly one mutation wire-wide, failure doesn't
consume the key, cross-tool reuse refused, dry-run ignores keys, bulk
batch replays as a whole).