v0.7.0

v0.7.0: security hardening, clickable history sparkline, leaner CI

Security review of the whole codebase, CI and git history (no secrets ever
leaked; details in the dossier's security-review.md). Twelve fixes:

Security
- CI: scope the signing-cert secret to the steps that need it (it was job-wide,
  so every step incl. the third-party release action could read it).
- CI: pin softprops/action-gh-release to a commit SHA (supply chain).
- selfupdate: allow-list the download URL (https + GitHub hosts only) and cap
  the download at 200 MB, streamed.
- selfupdate: add 'codesign --verify --deep --strict' so the signature's
  integrity is checked explicitly, alongside spctl notarization + Team ID pin.
- tabcount: bounds-check the pure-Python LZ4 decoder — a bad match offset used
  to silently produce garbage via negative indexing; now raises, output capped.
- permissions: open_website() only accepts https:// URLs.

Bugs
- login_item: XML-escape plist values (a path with & produced a malformed
  plist launchd silently ignored). Verified with plutil -lint.
- prefs: atomic write (temp + rename) so a crash can't truncate prefs.json.
- selfupdate: don't unmount twice on error paths.
- updates: cap the release-API response read at 2 MB.
- app: Save-dialog title is per-action ('Save Tab History' vs 'Export Open Tabs').

UI / CI
- Menu history line capped at 45 chars; clicking the sparkline now saves the
  history CSV (replaces the 'Reveal tab-history file' item).
- CI: concurrency group cancels superseded runs; drop redundant pip upgrade.
- README: mockup + docs updated for the clickable sparkline.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>