chore(release): prepare v0.7.0

[jo-hnny]

Summary

• Prepare the stable v0.7.0 release notes in English and Chinese.
• Cover every PR merged since stable v0.6.7 (chore(release): prepare v0.7.0-preview.1 #134, feat(diagnostics): preserve error causes and save redacted debug logs #139, fix(mobile): preserve background tunnel failure diagnostics #140, fix(diagnostics): complete boundary context for CLI failures #141, feat(api): promote Registry/Session and sync pre-cache contracts #143, fix(schema): derive RequiresAuth from API metadata #147, feat(instance): add sandbox snapshots and source cloning #148, fix(credential): avoid global token flag collisions #152).
• Update the version examples in the README and README-zh installation sections to 0.7.0.

0.7.0 is a minor release because Registry and Session/Space/Event commands move from preview to stable. The next preview release will be v0.8.0-preview.1, so that it stays newer than this stable release.

Changelog coverage

The baseline is the stable v0.6.7 binary. The release branch includes main through 5ad23c0 (#152). The original binary comparison below used b5003c9; the #152 follow-up evidence is recorded separately.

PR	Declared impact	Handling in the stable notes
#134	None	No stable change: release metadata for the preview channel only
#139	Stable and preview	Features: debug log files, --debug-log, cause preservation, GlobalFlags
#140	Stable and preview	Breaking Changes: instance mobile connect startup failure codes and exit codes
#141	Stable and preview	Features: Failure.Details context. Breaking Changes: NetworkError kind, instance login TTY_REQUIRED. Bug Fixes: download failure, config parse location, proxy diagnostic paths
#143	Stable and preview	Features: Registry, Session, --pre-cache-image-id. Breaking Changes: unknown command JSON help, pre-cache-image-task get missing-selector code. The interim Credential token ownership repair is superseded by #152 below. The session-space to session space migration is not listed: stable never shipped session-space
#147	Stable and preview	Bug Fixes: Deployment RequiresAuth. The Volume corrections are preview-only and excluded
#148	Stable and preview	Features: snapshots, clone, restore. Docs: instance delete help
#152	Stable and preview	Bug Fixes: use --workload-identity-token for the business JWT and restore global --token for cloud STS authentication. Flag-collision regression checks and the archive-runner correction are internal verification changes, without separate end-user release entries

Volume and VolumeTemplate remain preview-only and are excluded from the stable notes.

Breaking changes

The stable notes list every change to Failure.Code, Failure.Kind, or the exit code of an existing command. I found them by running the 66 commands shared by the v0.6.7 and target stable binaries with no arguments, with one positional argument, and with fake credentials against an unreachable endpoint, then comparing the code, kind, and exit code. I also checked instance login in a PTY and instance mobile connect with an occupied port:

Command	v0.6.7	v0.7.0
Cloud API calls with no response	ClientError.NetworkError, Kind=error, exit 1	Kind=network, exit 1
instance mobile connect startup failure	INTERNAL_ERROR, exit 1	Child classification, e.g. PORT_IN_USE exit 2, TUNNEL_AUTH_FAILED exit 4
instance login --non-interactive	CLI_ERROR, exit 2	TTY_REQUIRED, exit 2
pre-cache-image-task get without a complete selector	INVALID_USAGE / MISSING_REQUIRED_FLAG, exit 2	MISSING_REQUIRED_INPUT, exit 2
Unknown command with --help -o json	Root help, exit 0	INVALID_USAGE, exit 2

The Credential token collision repair stays under Bug Fixes. Both commands now use --workload-identity-token for the business JWT, while global --token supplies the cloud STS token; TENCENTCLOUD_TOKEN and config auth.token remain supported. There is no business-token alias for --token, and API request fields and response formats are unchanged.

The advertised business --token invocation was already broken in stable v0.6.7 and v0.7.0-preview.1: the workload JWT also became the cloud STS token, overwriting an environment STS token. The checksum-verified official binaries reproduced this in eight isolated TLS mock cases (two releases × two commands × with/without environment STS). These were local request-routing checks, not live E2E runs of the old releases. The rename repairs that authentication path, so it does not add a Breaking Changes entry. See #152's compatibility evidence and real E2E report.

Verification

Original release validation (b5003c9, before #152)

• bash scripts/changelog.sh validate-pair 0.7.0
• bash scripts/changelog.sh validate-release-notes-pair 0.7.0
• bash scripts/changelog.sh extract 0.7.0 <file>
• bash scripts/release-channel.sh v0.7.0: channel=stable, prerelease=false
• python3 scripts/test-release.py
• go run ./cmd/internal/apipatch check-all
• go run ./cmd/internal/cobragen check
• go test ./internal/apimeta/... -count=1
• HOME=<empty-temp-home> go test ./... -count=1
• HOME=<empty-temp-home> GOFLAGS=-tags=preview go test ./... -count=1
• git diff --check
• Built a stable binary with -X main.Version=0.7.0 and compared it with the v0.6.7 binary:
  • agr version -o json reports 0.7.0 and channel stable.
  • The command tree grows from 66 to 100 commands: 34 commands added (Registry, Session, Snapshot), none removed, no Volume commands.
  • Spot-checked the listed fixes against both binaries: debug log path, NetworkError kind, unknown command JSON help, Credential help, pre-cache-image-task get, config parse details, Deployment RequiresAuth, instance delete help, instance login failure code, and instance mobile connect with an occupied port.
• Built a preview binary from the same tree. Volume commands are present only in the preview build.

The original test suites ran with an isolated home and no cloud credentials. Their results above apply to b5003c9, not to the later credential repair.

Follow-up after #152

• The release branch at 2970d8a includes merged fix(credential): avoid global token flag collisions #152 (5ad23c0). All 18 CI checks passed on that release-branch head, including Linux/macOS stable/preview unit tests and both Release Ready checks. This is the pre-documentation-update CI result; the new push must pass its own CI.
• Re-ran validate-pair 0.7.0, validate-release-notes-pair 0.7.0, release-note extraction, stable channel classification, python3 scripts/test-release.py, and git diff --check for this documentation update.
• #152's real E2E report records 23 CLI calls against the real AGS service: 21 successful calls and two expected rejections, with temporary resources deleted and verified absent. It covers both token flags, argument placement/inline forms, environment STS authentication, missing workload JWT, invalid STS, secret readback, and OAuth authorization initiation.
• That live report applies to credential-change commit 398cf70; it was not rerun for the later archive-runner correction or this documentation update. OAuth third-party login, callback completion, and access-token exchange were not tested. No new live cloud E2E was run for this metadata-only follow-up.

Release impact

• Stable and preview
• Preview only
• Stable only
• None

Reason: The bilingual release notes record existing changes for v0.7.0, and the README installation/download version examples change for users of both channels. This PR adds no runtime or distribution behavior; those changes were introduced and validated by the merged implementation PRs.

[KayIter]

复审当前 head 4379536：同意合入。双语 v0.7.0 说明已覆盖 v0.6.7 之后的 8 个合入 PR，明确列出脚本可见的错误码/退出码变化，也写清 #152 的 --workload-identity-token 迁移及全局 --token 的 STS 用途。相对最新 main 仅改 changelog 和 README 版本示例；双语校验、发布脚本测试通过，当前 CI 全绿。此文档 PR 无需新增云端 E2E；具体功能的验证证据保留在对应实现 PR。合并后需另行发布 v0.7.0，避免 README 的新版本下载示例长期指向尚未发布的包。