Release checklist line

Scanner-safe bundle default

Required evidence

• bundle --profile scanner-safe, verify-bundle, inspect-bundle, and cargo xtask no-blob.
• Link the workflow run, artifact, or local command output in this issue.
• Update docs/release/evidence-matrix-v0.7.0.md if this line is promoted from Pending RC run to concrete evidence.

Claim boundary

This proves release readiness for a test-fixture promise. It does not prove cryptographic correctness or production key-management suitability.