chore: upgrade Edge Node to Holochain 0.7.0

[zippy]

Upgrades both container images from Holochain 0.6.1 to 0.7.0, along with the hApp tooling, test fixtures, and operator documentation.

What changed

Conductor and CLI

• New docker/conductor-config-0.7.0.template.yaml. Drops signal_url, which 0.7 rejects via deny_unknown_fields, and points relay_url at the bootstrap host, which serves the iroh relay in 0.7.
• hc 0.7 removed the sandbox call / zome-call / zome-call-auth subcommands. happ_tool and the harvester s6 script now use hc client call -p <port> and hc client zome-call*. The 0.5.6 regex fallback in extract_dna_hash is gone; the 0.7 list-apps JSON matches the existing jq path.

Test fixtures

• kando and volla-messages relay have no 0.7 builds, so fixtures move to ziptest v0.6.0-dev.0. Its .webhapp covers every case the old fixtures did: valid, invalid and missing checksum, bad URL, and webhapp extraction.
• multi_install.bats is re-enabled using ziptest's create_thing as an init zome call, and its assertion now measures the app-id count before and after so earlier tests' installs cannot satisfy it.

Harvester

• Builds log-harvester from its feat/adapt-to-holo-hosting-agreement branch: LANE_DEFINITION_IDS is required, the app websocket is attached by the s6 script rather than the harvester, and the agent key is logged at startup via whoami.
• unyt.happ pinned to v0.104.0 instead of releases/latest, which has been a 0.7 build since v0.101.0.
• LANE_DEFINITION_IDS plumbed through compose, cloud-init and OpenTofu.

Companion components

• log-sender bumped to v0.1.6, which meters the dht-*.db files of 0.7's flat databases/ layout. v0.1.5 read the old databases/dht/ directory, and the resulting error propagated into an unwrap, so the service crash-looped on every 0.7 node.
• @theweave/wdocker bumped to 0.16.0-dev.4 (the Holochain 0.7 client).
• happ_config_file 0.4.0: iroh-only templates, --webrtc removed, validate still accepts and warns about the legacy WebRTC fields.

Documentation

• deploy/DEPLOYMENT.md gains an "Upgrading to Holochain 0.7" section written after an empirical spike: the lair keystore survives if everything under the data root except ks is wiped, so an upgraded node keeps its agent key. The section also disqualifies the generic tofu apply -replace image-update path, which promises full data preservation and would start a 0.7 conductor on 0.6 databases.

Verification

Local runs on this branch head:

Suite	Result
edgenode bats	49 pass, 0 fail
harvester bats	11 pass, 0 fail
happ_config_file cargo tests	3 pass
arm64 0.7.0 binary URLs	both reachable

The final edgenode run downloaded log-sender v0.1.6 from its release rather than a local build.

Breaking

• No data migration from 0.6.x. Existing /data volumes must be reset before starting a 0.7 image, though the keystore may be kept. See the upgrade section in deploy/DEPLOYMENT.md.
• hApps built for Holochain 0.6 cannot be installed, and 0.7 networks do not interoperate with 0.6 networks, so all nodes in a deployment move together.
• Harvester deployments must set LANE_DEFINITION_IDS.

Known gap

h2hc-linker v0.1.2 is built against Holochain 0.6 crates. The linker service is not expected to work against a 0.7 conductor until v0.2.0 is released and the image is rebuilt with LINKER_VERSION=0.2.0. Recorded in the changelog and in the upgrade section.

Follow-ups

• Tag tools/happ_config_file-v0.4.0 after merge, then bump HAPP_CONFIG_FILE_VERSION in both Dockerfiles. Until then the images ship the 0.3.0 binary while the docs describe 0.4.0.
• release.yml pins the log-harvester checkout to a commit SHA on the 0.7 branch; drop the pin once that branch merges upstream.
• Holochain 0.7.1 when its release binaries are published.