v0.7.0

What's New

• Encrypted trust store — XChaCha20-Poly1305 encryption with HKDF-SHA256 key derivation, transparent migration from plaintext
• Forward secrecy session rekeying — ephemeral X25519 keypairs with automatic rekey on message count / TTL thresholds

Security Fixes

• Zero derived key material after SetEncryptionKey (crypto hygiene)
• Handle json.Marshal errors in rekey initiation/response and contact request
• Disconnect on session key failure, validate nonce length, track goroutines
• Handle errors from identity.Sign() and identity.SignEnvelope()

CI

• Add 70% coverage threshold gate