v2.7

chore(release): prepare v2.7.0 — version bump and documentation (#256)

- safeai/version.py 2.6.0 -> 2.7.0.
- CHANGELOG: cut [2.7.0] - 2026-10-22. Restores the evidence-metrics
  "Added" entry from #253, which the squash merge of #254 dropped while
  resolving the [Unreleased] conflict; adds the CI benchmark gate and
  roadmap alignment entries.
- RELEASE_NOTES: v2.7.0 notes with upgrade guidance (new
  CAP_subprocess_shell findings on wrapped calls).
- VALIDATION_REPORT: document both digests — committed records
  (--no-determinism, de9cb451...) and the default/CI path with
  determinism checks (ee76875d...), reproduced on Linux 3.11-3.13 and
  Windows 3.14 — plus a truth-maintenance entry for the six-case
  false negative fixed in #254 and the new CI gate.
- docs/manifest/README: v2.7 summary.evidence_metrics field section.
- ROADMAP: status table, Layer 2 metric status, P0 gaps, release log
  (v2.6.0 and v2.7.0).
- Implementation plan: v2.7.0 marked shipped; remaining v2.7 items
  re-scoped to v2.7.1 (test-only) and v2.8.0 (features) per SemVer.
- README release badge -> v2.7.0.

Signed-off-by: Ikarus Career Tech <ikaruscareer@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Winters <2954677+WintersCoder@users.noreply.github.com>