v0.6.7

• docs: explicit CEL comparisons for the claim-based WIF condition; say when each policy rule runs relative to decryption (bdfde43)
• docs: GitHub's OIDC token does carry an environment claim; sub is simply the mapping-free way to pin it (e28d6c5)
• cli: compare stored and decrypted SOPS scalars as values, not text (a1a28c6)
• cli: test assertions use the real temp path of the fake-backed SOPS file (0ba1ec9)
• cli: read the SOPS file once; decrypt and compare the same bytes (b2cffc1)
• cli: a SOPS value counts as unencrypted when it is stored exactly as it decrypts; WIF condition compares sub (0.6.7) (0b65616)