chore(release): v0.7.0 — version bump + Dependabot/security-alert triage

[thedancingdeveloper]

Release v0.7.0 (minor)

main is 26 commits past the released v0.6.2 tag with new user-facing features
(hands-free assistant WI-174, server-side voice-vocabulary biasing, task-bearing
agent sessions), so this cuts a minor release and folds in two net-new security
CI additions.

Version bump 0.6.2 → 0.7.0

Mirrors the prior release's file set, enforced by scripts/check_product_version.py:

• pyproject.toml, src/vogt/__init__.py, web/package.json, mobile/package.json
• .github/workflows/build.yml (VOGT_PRODUCT_VERSION= ×4)
• uv.lock (vogt package version)
• remaining pinned references: ci.yml check arg, deploy/*, docs/CUSTOMISATION.md,
  docs/DEPLOYMENT.md, scripts/clean_consumer_smoke.sh, tests/test_product_version.py

Mobile versionCode derives to 7000.

Security CI (folded in)

• .github/dependabot.yml — weekly pip/npm(web,mobile)/cargo(engine,voice)/docker/actions updates.
• .github/workflows/security-alerts.yml — scheduled triage opening one labelled
  security issue per open Dependabot/CodeQL alert, keyed by a stable marker so
  reruns update rather than duplicate.
• SECURITY.md — documents both, plus the required-check and Advanced Security
  settings. (Complements the dependency review workflow already on main.)

Verification

• python3 scripts/check_product_version.py 0.7.0 → pass
• tests/test_product_version.py → 2 passed

Follow-up (post-merge, operator)

Create prod from the release commit, tag v0.7.0, deploy vogt-prod via the
estate release lane, verify /version and both containers on the estate
prod-<sha> digests.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RTSDrvA1SAhWJ5du1e1BKb