feat: adopt standards verification 1.7.0

[krav01]

Summary

• adopt dev-standards 1.7.0 and public CI SHA 474ad9daa310517888f2da9168de6adaa78e2770
• enable Impact Planner v2 metadata
• harden forward-only upgrade validation with release-to-SHA checks
• add repository-wide immutable action pin scanning
• enforce a 5-minute fast-path duration budget for standards integrity

Risk

Low/medium: CI and standards metadata only; runtime code is unchanged.