feat: v1.7.0 release

[cody-rester]

Description

v1.7.0 release of Platform Atlas CLI. This release introduces the Standard/Extended tier system, Continuous Audit, Fleet Dashboard, outbound drift notifications, ControlMaster SSH transport, Local transport, Vault credential backend improvements, and numerous bug fixes and performance improvements.

Type of Change

• New feature

Changes Made

• Standard / Extended tier system — two distinct audit modes; Standard (Platform OAuth + IAG4 API, ~54 rules), Extended (full infrastructure, ~107 rules); three-layer enforcement via registry pruning, require_extended() guards, and tier-aware credential store
• Continuous Audit — scheduled drift monitor with OS-level scheduling (systemd/launchd), alert state, ack workflow, append-only event log, and CLI commands
• Outbound drift notifications — Slack and generic JSON webhooks with HMAC-SHA256 signing; alert-state-transition firing to avoid spam
• Fleet dashboard — platform-atlas fleet status multi-environment compliance overview; /fleet WebUI route
• ControlMaster SSH transport — piggybacks on existing OpenSSH ControlMaster sessions; designed for CyberArk PSMP environments
• Local transport for Platform node — reads config files and runs commands locally when Atlas is installed on the Platform server
• Kubernetes kubectl rule fallbacks — 13 rules now have alt_path for kubectl-only deployments
• What's New page — version-specific upgrade summary shown on first run after upgrade
• Vault credential backend improvements — token TTL introspection, automatic token refresh, thread-safe double-checked locking, revoke_token(), TOKEN_FILE/TOKEN_ENV/APPROLE_WRAPPED auth methods
• PLAT-048 — Template Builder Execution Timeout rule
• Dependency updates — paramiko 5.0.0, rich 15.0.0, rich-argparse 1.8.0, pyarrow 24.0.0, packaging 26.2, urllib3 2.7.0
• Removed deprecated --customer flag and associated dead code
• Numerous bug fixes (see CHANGELOG.md for full list)

Testing

• Tested against live P6 deployments in Standard and Extended tier modes
• Continuous audit enable/disable cycle verified on macOS (launchd) and Linux (systemd)
• Vault AppRole, token_file, and token_env auth methods verified

Checklist

• Code follows the project's style guidelines
• Self-review of code has been performed
• Code has been commented where necessary
• Tested with make setup or relevant profile
• Commits follow conventional format (type: subject)
• No secrets or credentials committed
• Documentation has been updated accordingly
• PR has been labeled appropriately (enhancement, bug, documentation, refactor, chore)