chore(main): release 0.7.1

[github-actions]

🤖 I have created a release beep boop

0.7.1 (2026-07-30)

Bug Fixes

• ci: make the docker dependency cache work and unbreak Dockerfile.bins (99b2b9a)
• ci: make the docker dependency cache work and unbreak Dockerfile.bins (a49e04d), closes #265 #266
• node: add a shared owner/name slug validator (#272) (51d82de)
• node: bound the slug owner by NAME_MAX, not the DID limit (#272) (27b0495)
• node: fail a sync row terminally when a non-directory holds the owner path (2e664b7)
• node: make a stalled sync queue visible, and fix two test claims (9aa4c17)
• node: move the attempted_at migration to v17, clear of two open branches (fbc5868)
• node: prove the mirror path is inside repos_dir before running git (#272) (3ca9473)
• node: reject a malformed slug at the notify boundary (#272) (c587a40)
• node: reset a peer's reachability gate when an announce changes its http_url (#270) (1964f88)
• node: reset a peer's reachability gate when an announce changes its http_url (#270) (e2560ee)
• node: stamp every dequeued sync row so a stuck one yields the batch (6e64d0d)
• node: stop a peer-supplied repo slug from escaping repos_dir (#272) (c70b1df)
• node: validate the queued slug before the worker derives a path (#272) (9f00e24)
• review: correct two comment claims and guard two more wrong shapes (#270) (811ad50)
• review: stop the dequeue overclaiming, and pin the starvation premise (457be11)

---

This PR was generated with Release Please. See documentation.

[beardthelion]

Approving. Verified at 8bd9edf: cargo metadata --locked is clean, and the merged state equals this head, so that check covers the merge result. Injected a manifest/lock mismatch to confirm the gate is real: clippy --locked fails with "cannot update the lock file ... because --locked was passed", and passes again once reverted. Patch bump is right, no feat or breaking-change commits in v0.7.0..HEAD. The Cargo.lock hunk is exactly the five workspace version lines with no dependency drift, which is the lock-sync job doing its job on its first release.

Three notes, none blocking:

Findings

• [P3] Deduplicate two changelog entries in a follow-up. CHANGELOG.md:6-9, :17-18. 99b2b9a/a49e04d and 1964f88/e2560ee repeat the same subject. This is new in 0.7.1; the 0.7.0 section has none. Every PR in the range landed as a two-parent merge commit and the queue's merge method is MERGE, so the merge commit's body repeats a branch commit's fix: subject and both get counted. The lever is the merge method, not release-please config, and I have not tested that switching it fixes this.
• [P3] Add the missing icaptcha-client entry, or accept the omission knowingly. 9be5eac is in the range with no changelog line, while every other branch-level fix: commit has one. It arrived on #213, whose merge commit body is a test: line. gl depends on that crate by path, so the change ships in 0.7.1 unlisted.
• [P3] Add crates/icaptcha-client/Cargo.toml to extra-files, or drop its annotation. release-please-config.json:10-16 lists five crates; crates/icaptcha-client/Cargo.toml:3 carries # x-release-please-version and sits at 0.4.0 while the rest moved to 0.7.1. Cargo.toml:15-17 claims every annotated crate is listed under extra-files, which is not true for this one. Pre-existing since #138, and it needs its own PR since hand edits here get regenerated.