v0.7.1

Added

• New OSS crate gaze-document for document → safe-bundle generation.
  Ships with PNG/JPG/PDF input support via Tesseract subprocess OCR (single-page
  PDF rasterization via pdfium). Output is a SafeBundle containing redacted
  Markdown + a restorable gaze::Manifest + an OCR/PII report. New gaze document clean <input> --out <dir> subcommand on gaze-cli (opt-in via --features document).
• Validator-veto pre-resolver phase for validator-backed recognizer failures.
  Invalid candidates are rejected before conflict resolution, then logged as
  loser-only audit rows with decided_by: ValidatorVeto and typed
  validator_fail_reason metadata. See
  docs/architecture/validator-veto.md.
• Collision-family metadata and FamilyPolicyTable for cross-class recognizer
  rivalries. Bundled core-extended now declares PAN-vs-IBAN and phone-family
  metadata, ConflictTier::CollisionPolicy is audit-serializable, adopter
  custom recognizers can declare non-reserved collision families, and
  xtask family-policy-table-coherence validates bundled declarations.
• Mandatory-anchor resolution for collision-family recognizers. Bundled locale
  cue blocks under [locale.cues.<key>] can keep structural candidates on their
  precise variant; missing anchors emit a family-level
  PiiClass::Custom("family:<name>") token plus AmbiguityReason::NoAnchor.
  xtask locale-cue-bundle-coherence validates bundled cue coverage.
• Ambiguity side-channel and bundled audit migration for v0.7.x collision
  handling. RedactionEntry can carry ValidatorFailReason and
  AmbiguityRecord; SqliteLogger migrates validator_fail_reason,
  ambiguity_record, collision_family, and collision_variant; CLI audit
  queries can filter ambiguity and collision metadata. See
  docs/architecture/ambiguity-side-channel.md.
• gaze-document opt-in mcp feature exposes gaze_read_file and
  gaze_read_text Tool impls that route document ingestion through
  PiiEnvelope::dispatch. Returns { clean_markdown, manifest_id, file_metadata }.
• gaze-cli opt-in mcp feature exposes gaze mcp install --client=<name>,
  gaze mcp doctor, and gaze mcp serve subcommands. Install writes client
  JSON with the absolute current_exe() path and an idempotent marker-fenced
  skill section in AGENTS.md. Ships claude-code, claude-desktop, and cursor
  at launch.

Changed

• [bundle-tokenization-drift] core-extended no-policy snapshot refreshed for
  mandatory-anchor fallback on structural IBAN candidates without loaded locale
  cue bundles.

Deprecated

Removed

Fixed

Security