v0.7.0 — three plugins become wasm modules

Three plugins that were compiled into every Covey binary are now WebAssembly modules, installable from the catalogue.

Module	Was held in the binary by	Cleared by
zammad	the webhook — HMAC, dedup, correlation and the wake decision are judgement, not field lookups	the webhook op
vulndb	scan_lockfile reads the lock file out of the agent's checkout	the read_file request
k8s	the cluster CA, with nowhere to put it	target.Credential.CA, brokered from k8s_ca

They need Covey 0.6.0 or newer — the capabilities above are not in 0.5.0.

Two things got smaller, and both are worth reading before upgrading.

vulndb_token no longer has an effect. A module is never handed a credential for a host it merely declared, and all six of vulndb's sources are declared, so NVD answers at its anonymous rate limit (5 requests per 30 seconds instead of 50). The advisory action survives it the way it survives any source that does not answer — a note beside the merged result.

k8s no longer takes ca_pem as an action parameter. Store the certificate as the secret k8s_ca and the host builds the trust store from it. This is a fix as much as a move: the certificate used to travel through the model's context, the guard-rail subject and the recording of every single call.

COVEY_ZAMMAD_REPLY_TYPE is now the optional reply_type parameter on reply. COVEY_ZAMMAD_INTAKE_GROUPS is gone — a Zammad trigger has had a condition on the group all along, and filtering there means the request is never made.

Verifying these artefacts. Each is built from this tag with -trimpath and the toolchain go.mod names (1.26.6), and the catalogue pins the digest below. The index rebuilds them from source on every pull request and refuses the entry unless the bytes match, so "we reviewed the code" says something about the binary you install.

f7370c888a08315cea14dedbb580aaea784950ab5d0d4c0936ea93dc995ceee3  zammad.wasm
85a9a6400bf6527bf9b9f428e1dc83d718d03863352122a9a5855f57215a6d4c  vulndb.wasm
dfd6fc580d4d8ec27de65bfbc05c270d1277a79bbf7a379838bc0e8a11c48041  k8s.wasm