feat: v0.7.0 — config plugins on a converged domain registry

[REPPL]

v0.7.0 — config plugins on a converged domain registry

Implements the signed-off v0.7.0 plan (docs/plans/2026-07-06-v0.7.0.md): the fn-5
domain convergence first, then seven config plugins on the converged registry, plus
the observability half.

fn-5 domain convergence (the enabler)

• One registry (internal/domains, cmd/registry.go) exposing FileDomain +
  ResourceDomain replaces the isZsh oracle and the hardcoded {"iterm2","terminal"}
  literals; the four file plan arms collapse into one kindFile path.
• The two-strip contract is preserved byte-for-byte (its trigger is now data-driven);
  dead plugin.Deploy/DeploySpec/OverlayKind scaffolding is deleted. A byte-stable
  zsh migration eval guards the cutover.

Seven config plugins

• git (~/.gitconfig) — hand-written git-INI parser; identity firewall
  (user.email/name/signingkey, gpg.program, credential.helper,
  credential.<host>.username, and every [includeIf] forced to the never-shared
  .local layer); native [include] overlay; URL/http.extraHeader token redaction.
• npm — ~/.npmrc with registry-token redaction; npm globals as a deps manager that
  coexists with brew/apt (names-only, install/reconcile-only).
• tmux — ~/.tmux.conf with a source-file .local sidecar and quoted-option secret
  redaction.
• macOS key bindings — repo-authoritative single file with plutil/bplist hygiene.
• Emacs — repo-authoritative ~/.emacs.d/ file tree with a volatile-path exclude
  filter and a per-file local/emacs/ overlay.
• iTerm2 — Dynamic Profiles JSON file-tree domain + global prefs via defaults import
  with a key allowlist and an "iTerm2 running" guard.
• Homebrew — Brewfile drift surfaced in status; deps scope gating reconciled.

Observability

• doctor observes the managed-target invariants (no-symlink / ~/.ssh / containment),
  read-only; export labels its reproducible bundle SHA256.

Verification

gofmt/go vet/make build clean; go test ./..., the full eval suite (FERRY_BIN),
and go test -race ./internal/... all green. consistency-lint and docs-currency-lint
clean; the plan is marked shipped. Every credential surface has a capture eval proving the
secret never reaches the shared repo; git has an eval proving identity is never shared
across machines. Reviewed by the security and ruthless reviewers — notably, review (not
tests) caught an npm tarball-spec RCE and two git identity-leak parser bugs, all fixed.

Breaking

• iTerm2's custom-prefs-folder mechanism is retired; iterm2 = true now imports an
  allowlist-filtered plist via defaults import (apply refuses while iTerm2 is running),
  and profiles move to the separate iterm2-profiles Dynamic Profiles domain. See the
  CHANGELOG Breaking section.

After merge

The CHANGELOG is pre-promoted to ## [0.7.0] - 2026-07-08 and the plan is marked shipped,
so scripts/release.sh v0.7.0 can cut the tagged release from main.

Known follow-ups (non-blocking)

• Emacs init.local.el with no shared counterpart does not deploy (strict per-shared-file
  overlay); the iterm2-profiles union-walk is the pattern to port over.
• iTerm2 PreferenceDomain.Restore lacks the apply-time running-guard (crash-recovery edge).
• tmux secret recognizer does not span-capture setw/trailing-comment/unquoted tokens
  (safe — degrades to a refusal, never a leak).
• The iTerm2 global-plist allowlist is a curated starter set to extend to taste.

Assisted-by: Claude:claude-opus-4-8