[dduugg]

Bumps codeowners-rs to 0.7.0, releasing the changes merged since v0.6.0.

Why 0.7.0, not 0.6.1

These are visible to consumers:

• Escape globs built from paths and fix them at the project root #149: globs built from paths escape glob metacharacters, and a package or .codeowner at the project root gets /**/**. A repo with a root package or .codeowner, or with [, { or ! in an owned path, gets a different CODEOWNERS file, so validate reports it out of date until it's regenerated. Plain bin/codeownership validate autocorrects, but CI that runs validate --skip-autocorrect fails until someone regenerates and commits.
• fix: run the real ownership checks when validate/gv are given paths #125: validate <files> and gv <files> run the full checks on the listed files. A list of files now fails on a file owned two ways, on an annotation, package or .codeowner that names a team that doesn't exist, and, under validate, on a file CODEOWNERS doesn't give its owner. Unowned files are reported under "Some files are missing ownership" rather than "Unowned files detected:". Git hooks and --diff CI can start failing on problems they used to miss.
• Normalize the paths validate, gv and for-file are given #148: paths given to validate, gv and for-file are normalized, so ./x, x/../x, // and absolute paths through a symlink get the answer their plain form gets.
• chore(ci): harden the release supply chain #128: this is the first release from the new pipeline. It's created as a draft, attested, given its DotSlash file and then published. Its DotSlash file has only the github-release provider, so DotSlash needs the gh CLI, and it records SHA-256 digests.

#150 changes tests only, and #147 bumps clap and similar.

Releasing

Merging publishes. The release job fires when the newest commit on main changes the version, and the squash merge makes this PR that commit. The release job now runs on ubuntu, and I checked the detection against this diff with Ubuntu 24.04's GNU grep 3.11: new_version=v0.7.0. Immutable releases are on, which #128's draft-then-publish flow is built for.

After merge

• Check the release: three archives plus the codeowners DotSlash file, gh attestation verify on each archive, and the DotSlash file running.
• code_ownership still pins v0.5.0. Run its suite against v0.7.0 before bumping the pin, since fix: run the real ownership checks when validate/gv are given paths #125 changes what validate <files> reports.