Why patch mode
==============

v0.7.0 ran the full minor-release evidence lane, including expensive
gates like `cargo xtask mutants-nightly --scope public`, the broad
perf suite, and new product profile proofs. That investment is right
for a minor release that changes the user-facing platform.

v0.7.1 is different: it hardens release tooling and the user install
path without changing public behavior. It only needs confidence that
release-system gates and the user path still work. Running the full
minor lane on every patch wastes CI time and dulls the signal of the
minor lane itself.

What the patch lane runs
========================

`cargo xtask release-evidence --version <V> --patch [--summary]`
selects `release_evidence_steps_patch()` which runs 10 focused steps:

1.  `public-surface`            — re-confirm exported API
2.  `check-file-policy`         — non-Rust file allowlist
3.  `publish-preflight`         — metadata + cargo package --no-verify
4.  `publish-check`             — ordered publish dry-runs (includes
                                  topology guard from #572 and
                                  publish=false dep guard from #578)
5.  `scanner-safe-reference --check` (#577) — scanner reference paths
6.  `cratesio-smoke --path . --skip-install-cli` (#580) — user path
7.  `docs-sync --check`         — docs are in sync with code
8.  `no-blob`                   — no secret-shaped blobs in test paths
9.  `examples-smoke`            — examples still compile / run
10. `impacted-evidence --base origin/main` — change-impact routing

What it deliberately omits
==========================

- `mutants-nightly --scope public` — full nightly mutation runs
  against `main` on schedule; targeted mutation already runs through
  `cargo xtask pr` when `impacted-evidence` flags the change.
- broad perf suite (`perf --compare`) — patch releases should not
  shift baselines; if they do, escalate to the minor lane.
- new product profile proofs (scanner-safe bundle, OIDC contract
  pack) — patch releases are not the venue to re-prove new profiles.

Receipt shape
=============

`ReleaseEvidenceReceipt` gains a `lane_mode` field (`"minor"` or
`"patch"`). The existing `lane: "release-evidence"` string is
preserved for backward compatibility with anything consuming the
shape; only the new field distinguishes the two lanes. The
release-evidence markdown gains a `Mode:` line; the summary opens
with a "Patch-mode evidence lane" callout when patch is set and
swaps the v0.7.0-specific gate table for the patch step list.

Tests
=====

- `release_evidence_patch_step_list_excludes_mutants_nightly`
- `release_evidence_minor_step_list_includes_mutants_nightly`
- `release_evidence_patch_step_list_includes_scanner_safe_reference`
- `release_evidence_patch_step_list_includes_cratesio_smoke`
- `release_evidence_patch_receipt_records_patch_mode`
- `release_evidence_patch_summary_announces_patch_lane`

Minor-lane callers (`release-evidence --version X [--summary]` with
no `--patch`) are unchanged in behavior and continue to run the
full 15-step lane.

Bump workspace version 0.7.0 -> 0.7.1 and seed the CHANGELOG entry
describing the release-hardening additions (#572, #577, #578, #580,
#581) and docs (#571, #579). No new product surface; no shim removal;
no profile work. Patch evidence lane passes.