v0.7.0

TL;DR

• New clean-VM testbed engine: a real end-user VM per worktree, a make e2e-release release gate, and a 15-scenario CLI suite recorded to asciinema — green on Linux and macOS.
• The credential broker now auto-starts on demand — agentjail secret set and shield grants no longer need a manual agentjail-secrets serve.
• Fixed a Linux shield read-leak: launching from $HOME no longer exposed ~/.ssh / ~/.aws / ~/.gnupg.

Added

• Clean-VM testbed engine (test/testbed/, ADR 0053) — persistent, isolated VMs (Lima/QEMU on Linux, Tart on macOS) that behave like a real end-user machine: full kernel (Landlock/Seatbelt), a service manager, no host mounts. agentjail is installed the true user way — a release-layout tarball fed to the shipped install.sh. make e2e-release resets to a clean golden, provisions, runs the e2e-smoke scenario, and exits non-zero on any failure.
• Recorded CLI scenario suite — 15 scenarios captured with asciinema, each with a structured pass/fail result. Recordings are auto-sanitized of host-identifying data before they are written.
• On-demand secrets broker auto-start (ADR 0058) — a loaded-but-not-running launchd/systemd definition that clients bring up on first use, with an idle self-exit that never tears down live grants. Ships as the sixth binary. Closes DEFECT-2.

Fixed

• Linux shield $HOME read-leak — the shield grants the working directory read-write; when launched with cwd == $HOME that grant swallowed the whole home tree, overriding the allowlist that withholds ~/.ssh, ~/.aws, ~/.gnupg. Launching from $HOME now grants only the non-hidden home children as a workspace and denies every dotfile/dotdir by default, matching the macOS shield. A normal project cwd is unaffected.
• --help on flag-passthrough commands — subcommands using DisableFlagParsing now intercept --help and print usage instead of forwarding it to the wrapped tool.