v1.7.0 release: qualify the supervised single-tenant Operator

[jeffhuber]

Part of #1096.

Goal

Qualify and publish v1.7.0 as a supervised single-tenant always-on Operator.

Dependencies

All v1.7 foundation, shadow, active-runtime, visibility, and provider-qualification issues must be complete.

Acceptance criteria

• Codex, Claude, and Devin each orchestrate at least one bounded delivery and participate as builder and independently eligible reviewer under the recorded policy.
• Closed-laptop operation continues through dispatch, review, fix round, and owner escalation.
• Kill/restart, duplicate event, lost webhook, API timeout, stale head, auth revocation, quota/rate limit, and rollback exercises pass.
• Board and CodeMower.com reconstruct the same metadata-only lifecycle and freshness state.
• Secret rotation, store migration, container upgrade, rollback, backup, and restore are rehearsed.
• The default release remains supervised with human merge approval.
• Canonical install, Operator setup, upgrade, rollback, provider, privacy, and troubleshooting documents pass a cold review.
• One immutable candidate is retained, soaked, independently audited, published without rebuild, and reinstalled from PyPI.

Non-goals

No multi-tenant SaaS control plane, unattended merge promotion, Git AI integration, Factory integration, quota-aware routing, or mandatory OpenAI Agents API dependency.

Code Mower delivery

Serial-release PR and workflow run. Resolve every P0/P1/P2 finding, attach exact-head audits and immutable artifact evidence, and publish only after the full supervised pilot acceptance matrix passes.