release: bump to 3.7.0 (develop)

[Jaro-c]

Summary

Bump podup to 3.7.0 in lockstep (the release workflow's verify job fails closed if any of the three drifts):

• Cargo.toml: 3.6.1 → 3.7.0
• Cargo.lock: regenerated to match
• debian/changelog: new entry at the top with the same version, full cycle changelog

Changelog covers everything merged into develop since 3.6.1:

• Added — podman-lane-develop-nightly workflow with 88% coverage floor on Podman 6 leg; per-engine project-label filter cache; write_frame shared helper.
• Fixed — interpolate_value gates parent mapping rebuild on mapping_needs_interp; progress ticker caches terminal + window probes at begin; progress_line short-circuits on SESSION_OPEN AtomicBool; identity_style caches PROJECT_PREFIX; restart_service_set returns Arc<HashSet<String>> halves; is_exec_teardown_noise anchors on read unixpacket; confirm_lost_response uses eq_ignore_ascii_case; libpod_pull_policy hard-errors on unknown values; Engine::run_lifecycle_hook takes stdout lock per-frame; libpod/client/mod.rs and engine/mod.rs both under 500-line cap.
• Changed — Podman baseline moved to 6.0.2 (re-validated via live lane on fresh Fedora rawhide cloud image; PODUP_SUMMARY pass=179 fail=0 flaky=0 on Podman 6 leg).

Validation

• cargo build --locked --bin podup --features test-helpers
• cargo test --locked --lib --features test-helpers — 1605 passed, 0 failed
• cargo fmt --all --check
• cargo clippy --locked --all-targets --all-features -- -D warnings

Release flow (follow-up)

After this lands on develop, the release flow is:

1. PR develop → main (merge commit) — that is the per-CLAUDE release PR. Head will be develop, so develop-only passes.
2. Push the tag v3.7.0 to main (or gh workflow run release -f tag=v3.7.0 -R Glyndor/podup). The verify job re-checks the three version files match, audits dependencies, then the build matrix produces the 7 targets; the release job signs, builds provenance, and publishes.