docs: additive-v2 propagation + optional-GC finalize; bump 0.7.0.0 (EGB-712)

CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to a four-digit MAJOR.MINOR.PATCH.MICRO version scheme.
 
+## [0.7.0.0] - 2026-06-08
+
+### Changed
+
+- **Additive store-format v2 (EGB-712)** — upgraded `secrets` clients now read
+  either external blob suffix (`.properties.age` or the legacy
+  `.gradle-properties.age`) and **dual-write** a `properties` external whenever a
+  v1 twin already exists in the store. Existing externals keep working for
+  teammates on an older `secrets`; only a brand-new `properties` external is
+  written v2-only (a gentle "upgrade to see it" forcing function). dotenv and
+  whole-`file` externals are unchanged across formats and always propagate.
+- **`secrets migrate --finalize` is now optional GC**, not a required milestone.
+  Because clients dual-write and read-fall-back, no teammate is ever cut off by
+  *not* finalizing; finalize only reclaims the duplicate v1 blobs, and stays
+  deferrable indefinitely. Its safety gates are unchanged. This defuses the
+  cross-machine "all clients must be v2 before finalize" coordination gate.
+
+### Added
+
+- **`secrets migrate --status`** now reports `v2-only` externals per project
+  (the ones an un-upgraded client cannot read), so you can see the forcing
+  function's footprint at a glance.
+
 ## [0.6.1.0] - 2026-06-08
 
 ### Changed