chore: bump SimpleX to 7.0.0; 6.5.2:5 → 7.0.0:0

[helix-nine]

Summary

Bumps the two upstream images to simplexmq v7.0.0 (from v6.5.2) and refreshes the tor-startos git dependency. StartOS version 6.5.2:5 → 7.0.0:0.

Both binaries ship from a single upstream release and are bumped in lockstep, per UPDATING.md:

image	from	to
simplexchat/smp-server	v6.5.2	v7.0.0
simplexchat/xftp-server	v6.5.2	v7.0.0

Upstream verification

• Newest stable tag via the UPDATING.md query (which filters out v7.0.0-beta.*): v7.0.0.
• GitHub flags this release prerelease: true — this is the documented upstream quirk UPDATING.md warns about (gh release view still returns v6.5.0). The tag is a plain vX.Y.Z, and Docker latest/v7/v7.0 all point at it.
• Both images confirmed published on Docker Hub for amd64 + arm64 (pushed 2026-07-29):
  • smp-server:v7.0.0 → sha256:caf2d6f5…
  • xftp-server:v7.0.0 → sha256:35aaf5a5…
• Image Entrypoint is /usr/local/bin/entrypoint on both images in both versions — unchanged, so sdk.useEntrypoint() still applies.

Major-version review

This is a major bump, so I diffed the upstream sources that this package actually depends on:

• FileTransfer/Server/Main.hs is byte-identical across the bump — the generated file-server.ini does not change.
• Messaging/Server/CLI.hs is byte-identical; init CLI flags (-y -l --password, and xftp's -p/-q) are unchanged, so initServers still works as written.
• Messaging/Server/Main/Init.hs (generates smp-server.ini) gains exactly one block: a new opt-in [NAMES] section for the new SNRC name resolver, with enable: off plus commented-out keys.
• Messaging/Server/Main.hs drops the [TRANSPORT] accept_service_credentials option (now hardcoded True). The package never modelled or wrote that key, so there is nothing to clean up.

No migration is needed. The package's INI models don't reference any changed key, and upstream defaults [NAMES] enable to False when the section is absent — which is the state the package's file model produces, since FileHelper.merge validates through the zod shape and the custom INI writer rebuilds the file from the model. Behaviour is identical to v6.5.2.

Release-notes highlights

Drawn from the upstream commit list for the 6.5.3 → 7.0.0 range (upstream's CHANGELOG.md stops at 6.5.1, so the release body is the real source):

• two SMP server memory leaks fixed (subscriptions #1820, service subscriptions #1827)
• SMP proxy reconnection to a relay after restart (#1806) — relevant to this package's Tor-proxy path
• hardening: decompressed-size limit (#1815), sntrup length validation (#1811), BBS proof validation (#1810), duplicate short-link updates rejected (#1813)
• bracketed IPv6 server addresses parsed (#1807)

Other changes

• tor-startos refreshed e3e2b53 → aa867cf (current #next tip).
• No SDK bump — @start9labs/start-sdk is already pinned at 2.0.9, which is npm latest.
• Lockfile converged to a fixed point (3 installs, byte-stable); one start-sdk copy on disk and no nested copy in the lock, as the existing overrides block intends.
• README.md / instructions.md need no edit for this bump: neither carries version strings, and the bump changes no user-visible behaviour.

Proposals (not implemented — for review)

1. Expose the new [NAMES] section? v7.0.0 adds opt-in public-namespace resolution, which needs an external SNRC resolver endpoint (resolver_endpoint, plus optional auth/timeout keys). It's off by default and requires infrastructure this package doesn't ship, so I left it alone rather than guessing at a UI for it.

2. instructions.md:39 looks inaccurate, and v7 makes it more visible. It says "anything else you set by editing the INI files directly in the config volumes will be preserved." In practice FileHelper.merge runs the parsed file through shape.parse (a z.object, which strips unknown keys) and the custom writer rebuilds the file from that model, so hand-added keys/sections are dropped on the next merge. This predates the bump, but [NAMES] is exactly the kind of section a user would now try to hand-enable. Worth either correcting the prose or modelling the extra keys — happy to do whichever in a follow-up.

Test plan

• npm run check (tsc) green at 7.0.0:0
• Prettier clean on the touched files
• Both v7.0.0 images resolve on Docker Hub for both arches
• 7.0.0:0 is free — registry's newest published version is 6.5.2:5
• make / s9pk build + install-and-run smoke test (PR review)