Prepare v0.0.7-rc.5 release

[BernardLowe]

Summary

• publish v0.0.7-rc.5 release notes for authenticated Writer session checkpoints
• document deterministic in-memory materializer export and strict restore validation
• advance README, security policy, release links, and release commands from rc.4 to rc.5

Compatibility

The checkpoint is a trusted-client local execution cache. It is not a portable transition, publication, freshness, or trust proof. This release does not change roots, CIDs, commitment parameters, commitments, proofs, transcripts, ProofLists, receipts, schemas, or wire encodings.

Validation

• git diff --check v0.0.7-rc.4...HEAD
• repository-wide gofmt check
• go test -p=7 -parallel=7 ./...
• GOARCH=386 go test -p=6 -parallel=6 ./auth/commitment/kzg ./auth/commitment/ipa
• sh scripts/test-verifier-wasm-vectors.sh
• scripts/test-writer-wasm.sh
• go vet -p=7 ./...
• go build -p=7 -buildvcs=false ./...
• temporary external consumer build against the candidate
• two independent scripts/build-wasm-release.sh v0.0.7-rc.5 builds under different ambient settings and umasks; byte-identical output
• scripts/check-wasm-release.sh and adversarial ustar validation
• independent release review: no actionable findings

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2623a3abd1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Validate malformed CIDs during state restoration

For a caller restoring corrupted or hand-constructed State, this overstates the validation performed: NewFromState only calls Defined() for roots and entry targets, so a malformed but nonempty cid.Cid is accepted. Either parse/cast every restored CID before installing it or narrow the release claim to undefined CIDs; otherwise invalid identifiers can enter the materializer despite the documented strict-validation guarantee.

AGENTS.md reference: AGENTS.md:L19-L20

Useful? React with 👍 / 👎.