v2.7.0 — post-v2.6.0 hardening & the #203 audit-trail epic

v2.7.0 is a MINOR, additive release: it hardens the phase engine, the learning loop, the renderer's write path, and the self-lint, and completes the #203 audit-trail epic. It groups 13 merged PRs (#204–#218) across issues #194–#202 + the epic children #213/#214/#215. No breaking changes; a legacy manifest renders unchanged.

Added

• Phase-state transitions are enforced — a delivery-state-consistent check rejects phase-skips (#199). delivery_state.checkpoints must be a legal, contiguous chain ending at the current phase, with confirmed_by on human-gated moves; a hallucinating agent can no longer set phase: scaffold without the intervening checkpoints.
• Fail-closed phase gates under --strict; the dead --links plumbing dropped (#200). Gate marks distinguish skipped (not applicable) from needs-input (a checkable input was withheld); --strict fails the phase on needs-input, so a gate can't be satisfied by omission.
• Interview provenance is enforced complete, not just well-shaped (#201). Every answer-bearing section needs a provenance entry (+ questionnaire_version), so a partial block no longer silently starves the learning loop.
• The agent-registry self-lint is now bidirectional (#202). A dead index link (a renamed/deleted persona) is caught, not just a missing persona.
• Live gate_results in a transition's checkpoint — the phase audit trail (#213). The checkpoint records the runner's own live evaluation of the deterministic gates, and — with at/confirmed_by — is the phase-tagged action record for every transition.
• Optimistic concurrency for the manifest — manifest_rev + --expect-rev (#214). Parallel sessions can no longer silently lose an update; a stale write is refused with a CONFLICT.
• Learning-loop coverage (#215). A refactor-phase --failure channel + phase-tagged records, a corpus-scaled autotune confidence floor, and redaction of sensitive override values.

Fixed

• yamlmini rejects folded > block scalars instead of silently dropping the body (#194) — the fix also recovered the notes bodies in every language profile.
• A second same-day run record no longer requires falsifying its date (#197).
• The learning-loop miners skip a malformed record instead of aborting the analysis (#198).

Security

• The renderer refuses to clobber pre-existing files — additive by default, --force to regenerate (#195).
• A .git path segment is rejected at validation time, not just at write time (#196).

---

Verified on main: 16 self-lint checks green (incl. version-lockstep + i18n-freshness), 44/44 test scripts pass. Full detail in CHANGELOG.md.