Seshat BI v0.7.1

Seshat BI -- v0.7.1 patch release candidate

This patch candidate records the single change merged to main after the frozen
v0.7 release note (docs/releases/v0.7.md). It does not rewrite the historical
claims captured there or in any earlier release note.

Why this patch exists

The v0.7.0 tag is frozen by the repository's v* tag-immutability ruleset and
points at a commit whose packaged seshat/pbi_mcp/scan.py trips the release
artifact inspector (scripts/inspect_release_artifacts.py). Because a protected
tag cannot be moved, v0.7.0 can never publish to PyPI. This patch carries the
inspector fix forward on a fresh, publishable version.

The v0.7.0 publish attempt failed closed: the build-and-validate job blocked
and the publish job was skipped, so no v0.7.0 artifact ever reached PyPI. Every
capability described in docs/releases/v0.7.md first becomes publicly
installable with this patch.

What this patch fixes

• Release inspector false positive blocking publication (PR #478): the
  macOS-user-path detection pattern in seshat/pbi_mcp/scan.py spelled the
  literal byte shape /Users/... that the release inspector scans shipped
  source for. The irony is structural -- scan.py is the secret scanner, and
  the flagged string was its own detection regex for leaked macOS paths in
  generated Power BI config, so the detector tripped on itself. No real path
  leaked: the matched text was /Users/[^/, i.e. regex syntax, and a repo-wide
  scan found exactly one hit. The pattern is now assembled from fragments so the
  literal never appears in shipped bytes; the compiled regex is identical and
  every detection case still fires. The inspector's regex is deliberately left
  strict -- no release guard was weakened. This follows the v0.6.1 precedent and
  a convention already used in tests/unit/test_pbi_mcp_generate.py.

Honest boundaries

• This is a packaging-only patch: it carries no functional code, schema, or
  CLI-behavior change. The compiled detection pattern is byte-for-byte
  equivalent to the one it replaces, so seshat pbi-mcp refuses exactly the
  same generated content it refused before. Every capability claim in
  docs/releases/v0.7.md continues to apply unchanged.
• Publication evidence is not asserted here. This candidate does not itself
  create a tag, publish to PyPI, create a GitHub Release, or submit to public
  Claude, Codex, or OpenAI catalogs. External marketplace publication and the
  GitHub Release object remain separate owner actions.