Publish y2 0.0.7 with guided authentication

[tobalo]

Summary

• publish the first Y2-native harness release as v0.0.7
• add y2 auth to open Y2 API Keys and securely save the key, while retaining y2 setup as a direct-entry alias
• harden the public installer latest-release diagnostic and finish the remaining Vercel/fx evaluation residue

Local verification

• zig fmt --check src/
• zig build
• zig build test
• focused CLI, ACP, web-fetch, evaluation-matrix, and TUI startup tests
• real ./zig-out/bin/y2 auth tmux interaction using a unique throwaway macOS Keychain account; browser open, secure save, clean exit, and credential cleanup verified
• installer syntax, shellcheck when available, and no-release diagnostic fixture

Release gates

• Full CI and the final ship gate must pass for the exact current commit before this draft is marked ready or merged.

[tobalo]

Release gate audit for 1717320b04bfa7a036df35d3b0318296c5fbf7ec:

• Source gate: SHIP. Exact Full CI passed all 20 native/E2E jobs and all four platform aggregates. Standard CI, startup benchmarks, binary-size checks, cross-target compiles, SDK checks, and Shellcheck also pass.
• Production release gate: HOLD. The apple-signing environment exists and is restricted to main, but its required variables and secrets are not configured.
• The PR remains draft and unmerged so the version-bump release workflow cannot publish unsigned or partial artifacts.

Required environment variables: Y2_SIGNING_IDENTITY, Y2_SIGNING_IDENTIFIER, Y2_SIGNING_TEAM_ID.

Required environment secrets: APPLE_DEVELOPER_ID_P12_BASE64, APPLE_DEVELOPER_ID_P12_PASSWORD, APPLE_NOTARY_KEY_P8_BASE64, APPLE_NOTARY_KEY_ID, APPLE_NOTARY_ISSUER_ID.

[tobalo]

Release policy update: the initial v0.0.7 CLI publication now packages checksum-verified macOS x86_64 and arm64 archives without Developer ID signing or Apple notarization. Apple signing remains deferred; the hardened signing helper and its focused tests remain in the repository for the later signed release. Local focused workflow tests, Zig formatting, build, version, and Y2-branded help smoke checks pass on commit ffd46f8. Waiting for exact-SHA Full CI before merge.

[tobalo]

SHIP on commit ffd46f8. Exact-SHA Full CI passed all 24 jobs and all four platform aggregates. PGSO attempt 2 passed all 56 jobs; the final report is eligible=true with 34 training and 48 candidate scenarios passed, zero corpus failures, and a 5.946 MiB macOS arm64 candidate. The initial macOS CLI archives remain explicitly not Developer ID signed or Apple-notarized.