v0.7.0

• Added. A conformance replay of generated traffic. The differentials in
  this package have always been fed by a hand-written corpus of a dozen
  requests, which bounds what they can disagree about — every finding of the
  0.6.0 wave lived just outside those dozen.
  rasuvaeff/property-testing-openapi builds requests from a document and
  knows by construction whether each is meant to pass; it depends on this
  package, so it can never be a dev dependency here, and a recording is the
  only way its traffic reaches this suite. 274 cases over 19 operations across
  both OAS versions now replay from
  tests/fixtures/generated-corpus/requests.json, asserting the verdict the
  case was built for and, when it was built invalid, that the rejection lands
  where the misuse was planted rather than somewhere convenient. What is
  recorded is the generator's intent, not our own verdict — a corpus of the
  latter would have faithfully pinned all four 0.6.0 bugs as correct
  behaviour. Verified by replaying it on 0.5.1: the bounded.create document
  will not compile and a valid numeric.create body is rejected. A failing
  case names the version the corpus was recorded against, so a moved
  verdict reads as a question about this package rather than as an
  unexplained disagreement.

• Changed. A header parameter is read as it was sent, not
  percent-decoded (#66). OAS says a header uses style: simple and simple
  style is RFC 6570 expansion, which does define an encoding — but HTTP treats
  a field value as opaque octets, no client in the wild escapes one, and the
  two mistakes are not symmetric: decoding a value nobody encoded corrupts it
  silently, while leaving an encoded value alone only makes a length or
  pattern assertion stricter than its author meant. X-Path: /a%20b used to
  become /a b, and X-Discount: 50% a broken escape. Decoding now happens
  where an encoding provably exists — path, query, cookie — and nowhere else.
  The price is named rather than hidden: a header value can no longer carry
  its own style delimiter, because there is no escape left for it. The change
  applies to response headers too, and closes the one live disagreement the
  generated differential in property-testing-openapi found against
  league/openapi-psr7-validator — the two now agree on the same request.