v0.7.0 — Security baseline: hardcoded secrets, external-call layering

New rule types

• forbidden_security_finding — flags hardcoded credentials, API keys, and tokens via a language-agnostic regex scan over raw source text: variable-name-shaped assignments (password = "...", api_key: "...") plus high-confidence literal patterns for AWS access keys, GitHub/Slack tokens, and PEM private-key blocks. Runs once per file during archsteer map, independent of per-language parsing — covers every extension archsteer already visits, with env-lookup and placeholder-value exclusions to keep false positives down.
• required_layer_for_external_call — confines outbound HTTP/SDK calls (and Salesforce Apex callouts) to a declared layer, mirroring the existing required_layer_for_data_access check but over external calls instead of data access.

Security baseline in every starter pack

java-spring, salesforce, python-service, and express-to-next all now ship two additional rules out of the box, each backed by a new ADR:

• no-hardcoded-secrets (error)
• external-calls-only-in-service (warn) — callouts confined to the service layer in Salesforce, service layer elsewhere

Validation

Spring PetClinic stays 100% conformant with the new rules active (no false positives). trailheadapps/dreamhouse-lwc's existing violations are unchanged — zero new noise introduced by the security rules. The repo's own dogfooded architecture.yaml now adopts no-hardcoded-secrets too.

Full diff: v0.6.0...v0.7.0