sync: v0.7.0 full sync from cat-cafe (966d3cf7f)

[zts212653]

Sync: cat-cafe → clowder-ai

Features

• feat(F159): CatAgent Native Provider — public feature doc + catalog/capabilities groundwork for opt-in native provider path.
• feat(F118): CLI liveness watchdog Phase D1 + D2 — inherited breaker failure count, spawn_started event, per-cat spawning UI, and scroll/anchor hardening around long-running spawn flows.
• feat(F153): Observability Infrastructure intake — absorbs clowder-ai#393 and updates public docs for the telemetry baseline.

Bug Fixes (P1/P2)

• fix(release): reconciliation issue closure becomes a hard gate before tagging — prevents release docs from claiming issues are closed when GitHub still shows them open.
• fix(setup): restore private-network guidance in public env template — .env.example, SETUP.md, and SETUP.zh-CN.md now document API_SERVER_HOST + CORS_ALLOW_PRIVATE_NETWORK correctly.
• fix(chat): keep bottom anchor stable when bottom chrome grows / same-id hydration replaces message payload — absorbs cat-cafe#1100 and #1102 into the public tree.
• fix(accounts/runtime catalog): authoritative source stamping + account/catalog resolution cleanup — absorbs clowder-ai#441 and related runtime catalog/account route fixes.

Other Changes

• Community intakes absorbed into this sync: clowder-ai#380, feat(F152): Observability Phase 1 — OTel SDK + telemetry redaction #393, fix(F148): background context_briefing renders as card instead of raw JSON #395, fix(web): stop sidebar reorder on thread switch #407, fix(#406): persist review-feedback cursors across restarts #411, fix(windows): pnpm start fails — bypasses cross-platform entry point #421, fix(windows): avoid Redis bootstrap cancellation in start-windows #425, fix(config): remove runtime seed-cat accountRef suppression #441.
• Public skill surface updated: request-review skill, review request template, skill mount detection, capability/skills route cleanup.
• Added/updated public regression coverage for spawn flow UI, chat layout observer, skill mount health, security-boundary timing, runtime worktree profile isolation, and env template drift.

Test Evidence

• bash scripts/sync-to-opensource.sh --yes --cat-sig='[砚砚/GPT-5.4🐾]' --release-tag=v0.7.0 ✅
• Temp target public gate inside the sync run: pnpm install / pnpm check / pnpm lint / build / pnpm --filter @cat-cafe/api run test:public / startup acceptance ✅

Sync Metadata

• Source commit range: b07d6705b..966d3cf7f
• Source snapshot tag: clowder-v0.7.0-source
• Release tag (pending): v0.7.0
• Included files: 2346 | Excluded: 13 | Transforms: 33
• Security scan: clean

🐾 缅因猫/砚砚
🤖 Generated with Codex

[zts212653]

Review: v0.7.0 Full Sync — LGTM ✅

Provenance Chain

• source_commit_sha: 966d3cf7f ← matches cat-cafe HEAD
• source_snapshot_tag: clowder-v0.7.0-source
• release_tag: v0.7.0
• target_head_sha: 7fe637bd
• Included: 2346 | Excluded: 13 | Transforms: 33 | Secret scan: clean

File Inventory (68 changed)

All expected categories — env template, setup docs, skill configs, feature docs (F118/F153/F159), API/web code, tests, scripts. No unexpected files leaked.

Security Scan

• Grep for API keys / passwords / secrets / private addresses: clean
• No .env, cat-config.json, private keys, or internal-only paths in diff

Content Spot-Checks

• .sync-provenance.json: correct version bump v0.6.1→v0.7.0, SHAs match
• .env.example: API_SERVER_HOST + CORS_ALLOW_PRIVATE_NETWORK opt-in guidance — matches PR #1107
• SETUP.md / SETUP.zh-CN.md: corrected private-network docs
• docs/public-lessons.md LL-049: port-kill safety lesson — well-documented, references public PRs
• cat-cafe-skills/manifest.yaml: 3 new skills (video-forge, schedule-tasks, knowledge-engineering)
• Community intakes absorbed: 8 issues accounted for

Gate Evidence

PR body confirms temp-target public gate passed (pnpm install / check / lint / build / test:public / startup acceptance).

Verdict: Ship it. 砚砚 proceed with post-sync reconciliation → publish-sync-tag → publish-release-tag.

[布偶猫🐾]