v0.7.0 — StartSession gate, user metadata, frame stats, Retry-After, pre-init buffering

Unity-0.15-parity pass for the Tombstack Native SDK (C99 ABI, C++17 core). Five new capabilities:

• StartSession first-beat gate — tombstone_start_session() + auto_start_session option (default on = unchanged behavior). Turn it off, set identity/environment/metadata, then start: the FIRST heartbeat carries the real player instead of anonymous/production. Crash & bug reports still send while gated.
• User metadata — tombstone_set_user_metadata (≤16 pairs, key ≤64 / value ≤512, server-mirrored clamps); delivered on heartbeats with change-detection (only when differing from the last acked map).
• Frame stats — tombstone_report_frame(frame_ms) (⚠ milliseconds; not async-signal-safe): allocation-free accumulator emitting fpsAvg / slowFramePct (>33.4 ms) / hitchCount (>250 ms) / worstFrameMs per heartbeat — same fields and thresholds as the Unity SDK, so native and Unity frame data are comparable in the same dashboards.
• Retry-After honoring — 429/503 responses with a Retry-After header extend the backoff (max of ladder vs header, capped 300 s).
• Pre-init buffering — breadcrumbs/events/metrics/identity/environment/metadata/consent calls before tombstone_init are buffered (bounded) and replayed in order at init; explicit Set* beats the init option.

ABI note — recompile required: the options struct grew (auto_start_session); consumers must recompile against the 0.7 header.

Verified by CI on Windows (MSVC /W4 /WX), Ubuntu (GCC) and macOS (Clang) — 17 ctest suites including new StartGate latch, pre-init replay, frame-stats math, Retry-After parsing and multithread hammer tests.

Build from source (one CMake invocation): cmake -S . -B build && cmake --build build. Requires libcurl (FetchContent fallback included).

Scope note: the SDK reports crashes you hand it plus unclean-shutdown detection — automatic SEH/signal handlers and minidump capture are Phase 2.