v0.7.0

Cross-version diagnostic foundation and baseline diagnostics. Selected scope: #409 capability-aware diagnostics with explicit older-cluster fallbacks; #410 ConfigMap/Secret consumer and propagation explanations; #411 ResourceQuota/LimitRange workload-creation evidence. Also selected, as small read-only improvements that add no cluster-write path: #517 picking up API resources the cluster starts serving during a session; #518 MCP tool annotations derived from each tool's declared effect; #519 copying a resource's name or a pane's text to the clipboard, masked values stay masked. Implement the shared foundation #409 before integrating its consumers; completing #409 does not require completing the separate feature issues. Preserve the existing v0.5.0 and v0.6.0 scopes and the version policy in #387. Diagnose from bounded, read-only evidence; determine availability from actual cluster capabilities rather than version strings, distinguish unsupported/denied/partial/stale/unknown states, and preserve approval, audit, redaction, and identity boundaries. No minimum Kubernetes version or release date is newly committed.