v0.7.2 — producer-side #69: npm-10-safe npx, gate-pin skew warning, version-stamped receipts

• npm ≤ 10 trap documented and routed around: github:owner/repo@tag is silently mis-parsed (exit 128, no output). All docs now use npx -y "git+https://github.com/amos-labs/plumbline#v0.7.2".
• plumb check warns on version skew between the local CLI and the repo's pinned gate version, with the exact fix command.
• plumb receipt --write stamps _stamped_by (CLI version) so producer/gate skew is readable off the receipt.
• 325/325 tests. Includes v0.7.1's hermetic diff binding (#74).

Consumers: bump workflow pins amos-labs/plumbline@v0.7.1 → @v0.7.2.