v0.7.1

Highlights

• Updated the container image to OpenCode v2.0.9.
• Added Fedora/SELinux-compatible bind mounts using private :Z labels.
• Added launcher regression coverage for SELinux mount options.
• Improved support for XDG Git configuration paths.

Security and Runtime Hardening

• Hardened the container build and runtime boundaries.
• Removed unnecessary runtime packages and capabilities.
• Preserved the read-only root filesystem, dropped capabilities, and
  no-new-privileges runtime configuration.
• Improved proxy handling without persisting proxy credentials in image layers.
• Added validation for the NodeSource signing key.
• Added file-based secret loading through /run/secrets.

Runtime Dependencies

• Updated runtime dependency collection for OpenCode v2.
• Updated npm and Context7 MCP dependencies.
• Included Git HTTP and HTTPS transport helpers.
• Improved handling of symlinked executables and shared libraries.
• Preserved shell links at /bin/sh and /usr/bin/sh.
• Removed obsolete X11 and Rust runtime dependencies.

Configuration and Documentation

• Updated OpenCode configuration and TUI configuration for v2.
• Updated build and manual-run examples to OpenCode v2.0.9.
• Documented SELinux bind-mount behavior.
• Updated container usage and security documentation.

Testing and CI

• Expanded bootstrap tests.
• Expanded runtime dependency collector tests.
• Added custom CA build verification.
• Added launcher regression tests.
• Added GitHub Actions coverage for the complete test and release pipeline.

Fixes

• Corrected the runtime dependency regression test.
• Removed the expectation for the nonexistent Debian Git helper
  git-remote-curl.
• Continued validating git-remote-http and git-remote-https.