Release v0.7.0

Added

• Object files committed into the local LFS store now respect
  core.sharedRepository (group/true/1 → 0o770/0o660;
  all/world/everybody/2 → 0o775/0o664; octal values such as
  0660 → that mode; unset / false / umask → fall through to the
  process umask). Directories under .git/lfs/ (objects/, tmp/,
  incomplete/) get the matching mode with read bits copied to
  execute bits. The tempfile crate creates files at 0o600
  unconditionally; we chmod after persisting so umask-respecting
  shells get the same mode they'd get from git itself. Wired through
  Clean / Smudge / FilterProcess / pull / fetch / checkout. Lands
  t-umask (4/4).
• git lfs clone --recursive (and --recurse-submodules) now runs
  git submodule foreach --recursive 'git lfs pull' after the
  top-level pull, so LFS content materializes in every nested
  submodule (git ≥ 2.9 forwards the disabled smudge filter to
  submodules, leaving them with pointer text otherwise). Lands
  t-clone::clone with submodules.
• http.cookieFile support: reqwest cookie jar populated from the
  configured Netscape-format file, attached to every transfer. Lets
  the LFS client traverse load balancers / proxies that gate access
  on a session cookie. URL-scoped overrides (http.<url>.cookieFile)
  win over global. Lands t-clone::clone (HTTP server/proxy require cookies).
• Action-URL expiration check before upload/download. The transfer
  queue now compares the batch response's expires_in (preferred when
  non-zero) / expires_at against now + 5s and fails the object
  with action "<rel>" expired rather than driving an already-stale
  URL into the wire. Lands t-expired (6/6). The matching
  t-push::push (retry with expired actions) still fails because that
  test requires the upstream retry-then-rebatch flow we haven't
  implemented yet.
• git lfs merge-driver, the LFS-aware Git merge driver. Wired into
  Git via [merge "lfs"] driver = git lfs merge-driver --ancestor %O --current %A --other %B --marker-size %L --output %A. Each of
  --ancestor / --current / --other is smudged into a tempfile
  (fetching the object on demand if needed), the three plus a fresh
  %D tempfile are substituted into --program (default
  git merge-file --stdout --marker-size=%L %A %O %B >%D), and the
  merged result is cleaned back into a pointer at --output.
  Non-zero merge program exit propagates as conflicts. Lands
  t-merge-driver (6/6).
• git lfs logs (and logs last / logs show <name> / logs clear /
  logs boomtown). Manages the crash-log directory under
  .git/lfs/logs/; boomtown is the deliberate-failure self-test that
  writes a sample log and exits 2. Lands t-logs.
• git lfs ls-files --deleted walks the ref's full history (matching
  scan_pointers's reachability semantics) so pointers reachable from
  prior commits but absent at HEAD still surface. Lands
  t-ls-files::reference with --deleted.
• git lfs ls-files --all <ref> now errors with Cannot use --all with explicit reference rather than silently ignoring the positional.
  Lands t-ls-files::--all with argument(s).
• url.<base>.pushInsteadOf is honored for upload + verify action URLs
  when lfs.transfer.enablehrefrewrite=true. Falls back to plain
  insteadOf when no push-direction alias matches, so the existing
  download behavior is preserved. New git_lfs_git::aliases::load_push_aliases
  and TransferConfig::upload_url_rewriter carry the push-direction
  rewrite separately from the download rewriter. Lands t-push::push with invalid pushInsteadof.

Fixed

• creds: gate the creds: git credential <sub> (...) trace line on
  GIT_TRACE so it stays silent when tracing is off. Matches upstream's
  tracerx.Printf behavior. Lands t-lock::lock multiple files, whose
  grep -v CREDS errlog assertion was tripping on the always-on lowercase
  line. Restores t-lock to 17/17.

• git lfs smudge <path> now honors lfs.fetchinclude /
  lfs.fetchexclude. When the path doesn't pass the filter, the
  pointer bytes pass through verbatim instead of triggering a
  download — matching git lfs filter-process and upstream's
  command_smudge.go. Lands t-smudge::smudge include/exclude.

• Temp-file cleanup at command startup now walks the full
  .git/lfs/tmp/ tree rather than only tmp/objects/. Files
  matching <64-hex>-... whose object is already complete are
  removed unconditionally; other files older than an hour are pruned,
  with subdirectories younger than an hour exempted (hard-linked
  cross-repo temp files can look stale but still be in use). Mirrors
  upstream's fs/cleanup.go. Lands t-tempfile.

• git lfs track listing now expands [attr]NAME macros from
  top-level .gitattributes, .git/info/attributes, and the user
  attributes file (core.attributesfile, default
  $XDG_CONFIG_HOME/git/attributes). Patterns like *.dat lfs are
  recognized as LFS-tracked when [attr]lfs filter=lfs ... is in
  scope, so git lfs track '*.dat' correctly reports
  "*.dat" already supported. Subdirectory [attr]NAME declarations
  are ignored (git itself rejects them as "not allowed:
  dir/.gitattributes:N"). Lands t-attributes (4/4).

• git lfs track blocklist check now matches upstream's git ls-files --ignored --cached -z -x <pattern> + basename-prefix logic rather
  than textually globbing the pattern against .gitattributes etc.
  Patterns that would match a forbidden file but where no such file
  is currently tracked (e.g. **/* in a fresh repo) now go through
  cleanly. Existing rejection of git lfs track .gitattributes, .git*,
  * still works because those patterns hit committed .gitattributes.
  Lands t-ls-files::list/stat files with escaped runes in path before commit (which sets up via git lfs track '**/*').

• git lfs ls-files (no args) now scans the index in addition to the
  tree at HEAD, so freshly-staged-but-uncommitted pointers show up.
  Falls back to the empty tree when HEAD doesn't exist yet, matching
  upstream's git.EmptyTree() path. The */- "is the working-tree
  file present?" check now joins against the repo root so invocations
  from a subdirectory report the correct marker. Lands t-ls-files
  tests 3–5, 8–9, 27–31 (10 tests).

• git lfs ls-files --json now uses single-space indentation and ends
  with a trailing newline, matching upstream's
  json.Encoder{SetIndent("", " "), Encode()}.

• git lfs push --all (and any push path with locally-missing pointers
  the server already holds) now reports Uploading LFS objects: 100% (N/N) instead of (M/N) when M < N because the missing-locally
  objects are already on the remote. They count as already-successful
  in both the object count and byte total. Lands t-push tests 9–12
  (4 tests).

• api: BatchResponse.objects[].size deserialization now rejects
  negative values with invalid size (got: -N), matching upstream's
  wording. Previously serde's default u64 decoder bailed with a
  generic type error. Lands t-push::push (with invalid object size).

• git lfs push exits with code 2 when any per-object upload fails
  (previously: code 1). Matches upstream's "push aborted" semantics
  and is what t-push::push with invalid pushInsteadof greps for.