jevnav v0.1.7

jevnav 0.1.7 — the release gate, and the pytest plugin.

This release can no longer ship from a red commit: publish.yml and
mcp-registry.yml call ci.yml as a reusable workflow and wait on it. 0.1.5
reached PyPI while CI was red on the same commit; that is now structurally
impossible, not just a rule.

The pytest plugin stops putting secrets in traces and stops losing actions:

• jev.fill("the password field", "${DEMO_PASSWORD}") reads the value from the
  environment and the trace records only the variable name (value_from_env).
  The docstring used to teach the literal-password flow.
• fill("") is recorded as the clear it is, and press records its key; both
  used to replay into a KeyError.
• The fixture uses the shared browser_session, so the browser closes even when
  the test fails.

dom_index is renamed rank — it was the element's position in its frame's
shortlist, never a DOM index. Same order, honest name.

204 tests (203 pass, 1 skip).