pakka v0.7.0

Validator hardening and calibration consistency release.

12 fixes across validator, meter, recall, report, stackgate, and a new shared claudecli package:

• report: fmtInt MinInt64 guard (stack overflow on crafted input)
• validator: single-char inline code ({1,}), braced/lowercase env vars, semver pre-release suffixes, case-insensitive markers, c#/f#/.proto fence language tags, trailing punctuation stripped from path captures
• meter: estimateTokens calibrated to 3.5 bytes/token (was 4, consistent with WriteSavings)
• recall: rune-safe preview truncation (no more split UTF-8 in JSON)
• stackgate: reject quote chars — explicit unquoted-argv contract
• claudecli: new internal package centralises claude -p argv construction
• orchestrator: RunAsync returns error, fork failures logged