[httpsphl]

Version bump for 0.7.0 (workspace, app and lockfile), and a flaky test fixed on the way.

Since 0.6.0:

• Delete a bot or a crew from its menu, with a confirmation that says what goes and what stays (feat: delete bots and crews (daemon and protocol) #54, feat(app): delete a bot or a crew from its menu #56); archived bots and crews listed in Settings, each with Delete (feat: archived bots and crews in Settings, each with Delete #58); the folder can go to the Recycle Bin when asked (feat: send a deleted bot's or crew's folder to the Recycle Bin when asked #60).
• Right-click a bot in the sidebar for its menu (feat(app): right-click a bot in the sidebar for its menu #55).
• Read marks in light blue, and the side panel comes back with the bot (feat(app): read marks in light blue, and the side panel comes back with the bot #52).
• The bot's browser fills its panel (feat(browser): the live page fills the panel #53), shows its tabs with reload and a typed address (feat(browser): tabs, reload and a typed address in the browser panel #62), and rests when nobody uses it (feat(browser): a browser nobody is using rests #65).
• Effort per bot and the conversation's space, with Compact now (feat(daemon): effort per bot, the context in use and compacting the conversation #63, feat(app): an effort slider and the conversation's space below the chat #64).
• A command request explains itself in plain words, with the command behind an arrow (feat: a command request explains itself in plain words, with the command behind an arrow #61).
• Bots no longer load the owner's personal CLAUDE.md or Claude Code's auto memory (fix(workspace): the owner's CLAUDE.md and auto memory stay out of the bots #66); a bot restarted before its first turn no longer tries to resume a conversation Claude Code never saved (fix(supervisor): resume a conversation only once Claude Code has it on disk #67).
• Installer and app say "Botloft" as publisher instead of "github", and adopt installs made under the old name (fix(installer): the publisher is Botloft, and installs made as "github" are adopted #57); botloftd.exe carries its name and version (feat(release): code signing ready to switch on, and a code signing policy #51).
• Releases: provenance attestation and SHA-256 in the notes (feat(release): attest where the installers come from, and list their SHA-256 #50), code signing wired in and off until there is a certificate (feat(release): code signing ready to switch on, and a code signing policy #51), the code signing policy linked from the README and each release (docs: the code signing policy in the download step and in each release's notes #68).

test(messages): the read-marks test from #52 failed once in #65's CI ("Unable to find an element with the text: Read") and passes alone; it now waits for the word in the timeline instead of reading it synchronously from the row found earlier.

After this and #65 merge: tag v0.7.0 and push; release.yml opens the draft release. Before publishing, both installers go through VirusTotal (Microsoft's engine flagged every 0.6.0 binary as Wacatac!ml).