2.7.0

What's Changed

• chore: bump the vitest trio to 4.1.11 past GHSA-82fw-gwwq-j7x9 by @cliffhall in #2315
• feat(test-servers): a CIMD showcase fixture that serves its own client metadata document by @cliffhall in #2307
• chore: land the #2247 round-9 review findings on v2/main by @cliffhall in #2322
• feat: bound every OAuth-path request with a deadline by @cliffhall in #2324
• fix: bold the labels, not the values, and give Connection Info's URLs full width by @cliffhall in #2329
• fix: exempt loopback hosts from the CIMD metadata URL HTTPS requirement by @cliffhall in #2326
• fix: state every test-gate timeout instead of inheriting a library default by @cliffhall in #2334
• fix: force the Storybook dep pre-bundle on every run (#2340) by @cliffhall in #2342
• chore: run each client's test suite once in local:gate, not twice by @cliffhall in #2343
• feat: queue concurrent local:gate runs on a machine-wide lease (#2339) by @cliffhall in #2344
• docs: record why maxWorkers stays unset, with the measurement (#2336) by @cliffhall in #2345
• chore: state the smoke-helper and CI wall-clock budgets (#2333) by @cliffhall in #2349
• chore: remove gate-lease.test.mjs temp directories after the suite by @cliffhall in #2351
• docs: stop justifying the asyncUtilTimeout pin by pointing at #2335 by @cliffhall in #2352
• fix: sample the SkillsScreen geometry only once the Frontmatter highlighter has landed by @cliffhall in #2353
• docs: correct two stale gate comments after #2354 (gate-lease MAX_WAIT_MS, main.yml table pointer) by @cliffhall in #2357
• docs: bring quality-gate.md up to date after #2338 and document the gate lease by @cliffhall in #2355
• chore(deps): bump ext-apps to 2.0.0 and drop the SDK-v1 shims by @cliffhall in #2358
• chore: refresh the stale ext-apps example in the sdk-watch comments by @cliffhall in #2361
• feat: bound connect attempts with a 30 s default connectionTimeout by @cliffhall in #2362
• fix: reset relay request-response waits on progress notifications (#2028) by @cliffhall in #2363
• docs: add an environment-variable reference by @cliffhall in #2366
• feat(core): report outstanding-request and notification-stream state on a request timeout (#2318) by @cliffhall in #2364
• fix: accept a path-less skill root URI in normalizeSkillUri by @cliffhall in #2368
• feat: add --protocol-era launch flag for ad-hoc servers by @cliffhall in #2372
• feat: make the skills verification catalog budget configurable per server (#2294) by @cliffhall in #2367
• fix: record an intercepted 401's status, headers and body in the network log by @cliffhall in #2371
• feat(web): configurable public addresses for the MCP Apps listeners by @cliffhall in #2370
• fix: report a gate-lease wait only when the run actually queued by @cliffhall in #2375
• Declare the skills extension in the Inspector's client capabilities by @cliffhall in #2374
• chore(release): bump to 2.7.0, audit clean, and fix sdk-watch suppression by @cliffhall in #2379
• feat(test-servers): stall an OAuth endpoint so #2319's timeouts can be driven by @cliffhall in #2383
• fix(test): AppRenderer theme flip — happy-dom drops GC'd MutationObserver callbacks by @cliffhall in #2386
• docs: pack:verify is not a local:gate stage — name it as its own release step by @cliffhall in #2387
• chore(release): merge v2/main into main for v2.7.0 by @cliffhall in #2381

Full Changelog: 2.6.0...2.7.0
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.7.0