release: bump pkg/npm + pkg/pypi to v0.7.0

The release.yml workflow publishes both wrappers as-is from the repo;
they were still pinned to 0.6.1, which made the npm publish step try to
republish v0.6.1 instead of v0.7.0.

fix(release): atomic publish — un-draft GH release only after registr…

…ies succeed

Previously the un-draft step ran inside the verify job, before
publish-registries. If npm or PyPI publish failed, the GitHub release
was already live but the wrappers were not — half-shipped state.

Move the un-draft into a new publish-final job that needs both
[verify, publish-registries]. If any registry fails, the GH release
stays in draft and the run can be re-tried with replace=true.

Fix VirusTotal gate: accept completed scans with < 60 engines

VT's status=completed is final — no more engines will report. The script
was polling indefinitely when ARM binaries only reached 50/76 engines.
Now accepts any completed scan, logs a NOTE when below MIN_ENGINES.

VT gate: all files block equally, no warnings — scripts can contain h…

…armful code too

Add simulated binary replacement to smoke tests (Phase 6e)

Tests the update command's replacement flow without network calls:
copy binary as "downloaded" version, unlink-then-replace the
"installed" version, verify replaced binary runs --version.
Also tests read-only binary replacement edge case (#114).

Fix Windows build: guard POSIX-only tests with #ifndef _WIN32

Path containment tests use realpath() and mkdir(path, mode) which are
not available on Windows. Shell-free exec tests already guarded.

Fix snippet tests: align with simplified get_code_snippet handler

The snippet handler now uses exact QN + suffix matching only (no fuzzy/auto-resolve).
Updated 3 tests to match: fuzzy_suggestions, fuzzy_last_segment, auto_resolve_enabled.

Release RAM after indexing, static-link Windows binary

- Call cbm_mem_collect() (mi_collect(true)) after pipeline_free in both
  index_repository and auto-index, returning mimalloc pages to OS
- Add -static to Windows linker flags so the binary is standalone
  (no libc++.dll / libunwind.dll dependency)

Fix MCP protocolVersion: return plain string, not nested object

protocolVersion was {"version":"2024-11-05"} — MCP spec requires "2024-11-05".
Claude Code rejected the malformed response and marked the server as failed.

Restore session auto-detect + auto-index + config CLI from Go

- Config store: persistent SQLite key-value in _config.db (get/set/delete/bool/int)
- Config CLI: codebase-memory-mcp config list|get|set|reset
  Keys: auto_index (default false), auto_index_limit (default 50000)
- Session detection: detect project root from CWD on MCP initialize
- Auto-index: if auto_index=true and project not yet indexed, background pipeline
- Watcher hookup: after index completes, register project for ongoing git polling
- 6 new config store tests (open/close, get/set, bool, int, delete, persistence)

Enable auto-indexing:
  codebase-memory-mcp config set auto_index true