Repository tooling 0.7.0

Repository tooling 0.7.0

Local bootstrap and preflight no longer require publishing credentials. Bootstrap validates the
toolchain before installing dependencies and preserves existing local environment files. Configure
local examples and optional integrations through the versioned tooling declaration. Production setup
remains explicit through --production. Documented future-only credentials are never provisioned or
rotated; generated secrets wait while another target cannot be observed.

lvbt check now verifies standard integrity and reports command-contract drift. Consumer root
commands match the templates, with product checks ordered by Turbo. New command rules warn in this
minor release and become required in 0.8.0. The updater adds shared Turbo cache inputs for the
standard fingerprint, tooling declarations and root workflows while preserving product globals and
tasks. Missing inputs warn in 0.7 and fail from adopted 0.8 releases. Template publication executes
the selected release's own updater, so repeated publication cannot inherit a different running
standard's policy.

Audited transitive overrides now come from the shared CLI catalog and update through the same
incoming updater, preserving application-only pins. Missing shared pins warn in 0.7 and become
required in 0.8. The security baseline selects Sharp 0.35.5 and an exact reviewed temporary Braces
depth-guard backport. See Dependency policy for provenance and replacement
criteria. Templates preserve their full dependency audit and full-history secret scan as uncached
parts of pnpm check.

lvbt audit runs shared link, Lighthouse, and dependency adapters. Trusted scheduled reports
maintain one readable issue per check and target through the contribution helper, including verified
recovery and regression handling. Errors and incomplete checks cannot close issues. The reporter
verifies the run attempt's successful prerequisites and retained evidence before reconciling.
Recurring product reports use the same contribution backend, with reviewed adoption of existing
automation issues and optional pinning.

The web-platform package now provides shared saved-release orchestration and lvbt promote. Main
updates staging; production promotion verifies a saved artifact without rebuilding. Signed
inventories verify the reviewed shared signer and source revision. Named staging supports Durable
Objects with separate credential environments and immutable same-run acceptance receipts. Draft
profiles cannot promote, and shared public R2 datasets expose only read capabilities in staging.
Previously retained website artifacts remain readable through exact reviewed run, commit, artifact
ID, and expiry declarations. The compatibility path independently downloads and verifies the
retained bytes; new artifacts always require signed proof. Consumers migrate their application-owned
workflows and configuration explicitly; updating the vendor snapshot alone does not complete
adoption.

Repositories declaring saved releases cannot bypass promotion through lvbt deploy; it permits
configuration dry runs and names the staging/promotion correction before any provider operation.
Shared pull-request previews preserve repository-owned browser acceptance and clean up only their
derived preview Worker. Initial production adoption or recovery can name an expected provider
version; a changed version stops publication before production writes.

See Developer workflow for the command contract and ownership boundaries.

Shared ESLint entry points ship declarations, so TypeScript consumer configurations need no local
module shims. Release build and publication checkouts include full Git history for the required
secret scanner and published-updater compatibility tests.