chore: bump version to 0.7.1, revert tag workflow to --target, update changelog

- Bump workspace version 0.7.0 → 0.7.1 in root Cargo.toml
- Revert release workflow to gh release create --target for workflow_dispatch
  (the git-push approach from zeroclaw-labs#5860 is blocked by the org Restrict creations
  rule; --target uses the Releases API which bypasses it, and v0.7.1 has no
  immutable release lock so the previous blocker does not apply)
- Update CHANGELOG-next.md: retitle to v0.6.9 → v0.7.1, restore full
  comprehensive notes from the upstream draft, and add entries that were
  missing from the original v0.7.0 draft:
    - feat(observability): otel_headers for authenticated OTLP exporters (zeroclaw-labs#5700)
    - feat: GitHub Copilot provider onboarding (zeroclaw-labs#5321)
    - fix(channels/telegram): inline_keyboard for tool approval requests (zeroclaw-labs#5790)
    - fix(provider): strip tool_stream for non-Z.AI providers (zeroclaw-labs#5806)
    - fix(agent): normalize empty successful tool output (zeroclaw-labs#5565)
    - fix(web): theme mode switch not applying correctly (zeroclaw-labs#5724)
    - fix(web): add visual preview swatches to theme selector (zeroclaw-labs#5767)
    - fix: cron_run tool output not delivered to configured channels

Author: WareWolf-MoonWall

.github/workflows/release-stable-manual.yml

@@ -444,22 +444,23 @@ jobs:
           EVENT_NAME: ${{ github.event_name }}
           COMMIT_SHA: ${{ github.sha }}
         run: |
-          # For manual dispatch, push the tag explicitly via git first using
-          # the RELEASE_TOKEN checkout (admin PAT bypasses tag protection rules),
-          # then create the release for the existing tag. This avoids the GitHub
-          # "tag_name was used by an immutable release" API error that --target
-          # triggers when a same-named tag was previously used by a deleted
-          # immutable release.
-          # For tag push, the tag already exists — skip straight to release creation.
+          # For manual dispatch, use --target to create tag + release atomically
+          # via RELEASE_TOKEN (admin PAT) which bypasses tag protection rules.
+          # For tag push, the tag already exists — just create the release.
           if [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then
-            git tag "$TAG" "$COMMIT_SHA"
-            git push origin "$TAG"
+            gh release create "$TAG" release-assets/* \
+              --repo "$GITHUB_REPOSITORY" \
+              --title "$TAG" \
+              --notes-file release-notes.md \
+              --target "$COMMIT_SHA" \
+              --latest
+          else
+            gh release create "$TAG" release-assets/* \
+              --repo "$GITHUB_REPOSITORY" \
+              --title "$TAG" \
+              --notes-file release-notes.md \
+              --latest
           fi
-          gh release create "$TAG" release-assets/* \
-            --repo "$GITHUB_REPOSITORY" \
-            --title "$TAG" \
-            --notes-file release-notes.md \
-            --latest
 
       - name: Remove CHANGELOG-next.md after stable release
         shell: bash

CHANGELOG-next.md

@@ -1,4 +1,4 @@
-# Changelog — v0.6.9 → v0.7.0
+# Changelog — v0.6.9 → v0.7.1
 
 > Changes since the **v0.6.9** stable release. This release represents the largest
 > structural overhaul in ZeroClaw's history: the entire codebase has been split into a
@@ -35,6 +35,12 @@
   mentioned), encrypted media download restored, outbound attachment support added, and
   onboarding wizard preservation.
 
+- **GitHub Copilot onboarding** — GitHub Copilot is now selectable as a provider
+  through the onboarding wizard and `zeroclaw config` flow (#5321).
+
+- **Authenticated OTLP exporters** — New `otel_headers` config key lets you pass
+  custom headers (e.g. `Authorization: Bearer …`) to protected OTLP endpoints (#5700).
+
 ---
 
 ## What's New
@@ -63,8 +69,12 @@
 
 - **OpenRouterProvider** now supports streaming (#5717). Responses appear token-by-token
   instead of arriving all at once.
+- **GitHub Copilot** is now available as a selectable provider in the onboarding wizard
+  and `zeroclaw config` interactive flow (#5321).
 - Fixed: native tool-call messages are now stripped before sending to providers that
   have `native_tool_calling = false`, preventing provider errors (#5762).
+- Fixed: `tool_stream` events are no longer forwarded to non-Z.AI providers in the
+  streaming path, preventing unexpected provider errors (#5806).
 - Fixed: DeepSeek V3.2 system prompt escaping and token estimation corrected (#5454).
 
 ### Channels
@@ -73,6 +83,8 @@
 - **Matrix**: mention-only filtering — the agent can be configured to respond only when
   directly mentioned. Encrypted media download restored. Outbound attachment support
   added. Onboarding wizard settings now preserved across restarts (#5166, #5727).
+- **Telegram**: tool approval requests now include `inline_keyboard` markup, giving
+  users interactive approve/deny buttons instead of plain text (#5790).
 - Sender user ID is now propagated into the channel system prompt, giving the agent
   context about who it is talking to (#5526).
 - Email and VoiceCall channels now have an `enabled` field and are correctly wired into
@@ -102,26 +114,37 @@
 - Nostr, WhatsApp Web, and hardware wizard sections wired into the onboarding flow
   (#5640).
 
+### Observability
+
+- **`otel_headers`** — new config key for passing arbitrary HTTP headers to OTLP
+  endpoints. Enables authenticated exporters (e.g. Grafana Cloud, Honeycomb) without
+  environment variable workarounds (#5700).
+
 ### Web Dashboard
 
 - Voice mode added to the dashboard.
 - Plugins management page added.
+- Theme mode switch fixed — light/dark selection now applies correctly on load (#5724).
+- Visual preview swatches added to the theme mode selector (#5767).
 - Dashboard is now decoupled from the main binary — built separately and embedded at
-  release time. Included in binary releases, AUR, Homebrew, and `cargo install` (#5675,
-  #5665).
+  release time. Included in binary releases, AUR, Homebrew, and `cargo install`
+  (#5675, #5665).
 - Web build logic moved into the gateway crate; no-op recompiles (previously ~1 minute)
-  eliminated (#5ec5f2a6).
+  eliminated.
 
 ### Agent & Runtime
 
 - CLI channel factory now registered for interactive mode — `zeroclaw` interactive
   sessions work again after the workspace split (#5802).
 - Duplicate `ToolCall` events in `turn_streamed` deduplicated; clients no longer see the
   same tool call reported twice (#5746).
+- Empty successful tool output is now normalised before being returned to the provider,
+  preventing downstream parse errors on blank responses (#5565).
 - Session integrity improvements: streaming refactor and history pruning for long
   conversations (#5167).
 - Cron agent jobs no longer trigger `auto_save`, preventing runaway memory consolidation
   on scheduled tasks (#5664).
+- Fixed: `cron_run` tool output was not being delivered to configured channels.
 - Windows: the shell console window is now hidden when running as a background process
   (#5563).
 
@@ -157,12 +180,16 @@
 | Area | Fix |
 |------|-----|
 | Provider | Strip native tool messages for non-native-tool-calling providers |
+| Provider | `tool_stream` events forwarded to non-Z.AI providers in streaming path |
 | Provider | DeepSeek V3.2 system prompt escaping and token estimation |
 | Agent | CLI channel factory missing in interactive mode |
 | Agent | Duplicate ToolCall events in streaming turns |
+| Agent | Normalize empty successful tool output |
 | Matrix | Encrypted media download; outbound attachments |
 | Channels | Missing Arc Provider forwarding methods |
 | Channels | `<think>` tag leaking into streaming draft updates |
+| Telegram | `inline_keyboard` missing from tool approval requests |
+| Cron | `cron_run` tool output not delivered to configured channels |
 | Config | False "Unknown config key" warnings on Option fields |
 | Config | Temperature validation missing from providers loop |
 | Config | Fallback key references nonexistent provider — now warns |
@@ -172,6 +199,8 @@
 | Install | install.sh broken after workspace split |
 | Runtime | Windows console window visible in background mode |
 | Distribution | Web dashboard missing from AUR and cargo install builds |
+| Web | Theme mode switch not applying light/dark correctly |
+| Web | Theme mode selector missing visual preview swatches |
 
 ---
 

Cargo.lock

@@ -3,27 +3,27 @@ members = [".", "crates/zeroclaw-api", "crates/zeroclaw-infra", "crates/zeroclaw
 resolver = "2"
 
 [workspace.package]
-version = "0.7.0"
+version = "0.7.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/zeroclaw-labs/zeroclaw"
 rust-version = "1.87"
 
 [workspace.dependencies]
-zeroclaw-api = { path = "crates/zeroclaw-api", version = "0.7.0" }
-zeroclaw-infra = { path = "crates/zeroclaw-infra", version = "0.7.0" }
-zeroclaw-config = { path = "crates/zeroclaw-config", version = "0.7.0", default-features = false }
-zeroclaw-providers = { path = "crates/zeroclaw-providers", version = "0.7.0" }
-zeroclaw-memory = { path = "crates/zeroclaw-memory", version = "0.7.0" }
-zeroclaw-channels = { path = "crates/zeroclaw-channels", version = "0.7.0", default-features = false }
-zeroclaw-tools = { path = "crates/zeroclaw-tools", version = "0.7.0" }
-zeroclaw-runtime = { path = "crates/zeroclaw-runtime", version = "0.7.0", default-features = false }
-zeroclaw-tui = { path = "crates/zeroclaw-tui", version = "0.7.0" }
-zeroclaw-plugins = { path = "crates/zeroclaw-plugins", version = "0.7.0" }
-zeroclaw-gateway = { path = "crates/zeroclaw-gateway", version = "0.7.0" }
-zeroclaw-hardware = { path = "crates/zeroclaw-hardware", version = "0.7.0" }
-zeroclaw-tool-call-parser = { path = "crates/zeroclaw-tool-call-parser", version = "0.7.0" }
-zeroclaw-macros = { path = "crates/zeroclaw-macros", version = "0.7.0" }
+zeroclaw-api = { path = "crates/zeroclaw-api", version = "0.7.1" }
+zeroclaw-infra = { path = "crates/zeroclaw-infra", version = "0.7.1" }
+zeroclaw-config = { path = "crates/zeroclaw-config", version = "0.7.1", default-features = false }
+zeroclaw-providers = { path = "crates/zeroclaw-providers", version = "0.7.1" }
+zeroclaw-memory = { path = "crates/zeroclaw-memory", version = "0.7.1" }
+zeroclaw-channels = { path = "crates/zeroclaw-channels", version = "0.7.1", default-features = false }
+zeroclaw-tools = { path = "crates/zeroclaw-tools", version = "0.7.1" }
+zeroclaw-runtime = { path = "crates/zeroclaw-runtime", version = "0.7.1", default-features = false }
+zeroclaw-tui = { path = "crates/zeroclaw-tui", version = "0.7.1" }
+zeroclaw-plugins = { path = "crates/zeroclaw-plugins", version = "0.7.1" }
+zeroclaw-gateway = { path = "crates/zeroclaw-gateway", version = "0.7.1" }
+zeroclaw-hardware = { path = "crates/zeroclaw-hardware", version = "0.7.1" }
+zeroclaw-tool-call-parser = { path = "crates/zeroclaw-tool-call-parser", version = "0.7.1" }
+zeroclaw-macros = { path = "crates/zeroclaw-macros", version = "0.7.1" }
 aardvark-sys = { path = "crates/aardvark-sys", version = "0.1.0" }
 
 [package]