chore: release 4.7.0

[kevintseng]

Cuts 4.7.0 from main. Version bump and changelog only — no code changes.

4.6.3 was never published, and nothing in the repository claims otherwise:
there is no [4.6.3] section and no v4.6.3 tag. So 4.7.0 follows 4.6.2 with
no gap to explain.

Why a minor, not a patch

Three user-visible contract changes ship here, each under its own changelog
heading:

• user_patterns no longer returns toolPreferences or
  workflow.avgSessionMinutes (both were permanently empty — parsed from a
  text format nothing has ever written).
• DEFAULT_SIGNAL_THRESHOLD is gone; it described a dashboard filter that does
  not exist.
• memesh import no longer exits 1 for a relation whose target is not in
  the bundle. Those relations are still reported — by name, in a new
  skipped_relations field — but every bundle narrowed by --tag,
  --namespace or --limit has them, so counting them as errors made
  memesh export > b.json && memesh import b.json a failing command on a
  correct restore. Scripts that check the exit code are affected.

The eight anchors

package.json, .claude-plugin/plugin.json, .claude-plugin/marketplace.json,
both package-lock.json entries, docs/ARCHITECTURE.md,
docs/api/API_REFERENCE.md, and [Unreleased] → [4.7.0].
dist/skills-manifest.json is the eighth: it carries a sha256 of
plugin.json, so a bump that does not rebuild leaves it pointing at the
previous file. scripts/check-version-coherence.mjs verifies all of them.

Verification

node scripts/run-tests-isolated.mjs -> Test Files 185 passed (185) / Tests 2528 passed (2528), exit=0
npm run verify:release                -> exit=0 (all eight anchors agree at 4.7.0)
CI on e2a179c5 (the head this release contains) -> 13/13 pass

After merge, npm run release:finish from main creates the tag and the
GitHub Release in one API call, which is what triggers the npm publish.
Between the merge and that call, verify:release on main will FAIL with
"main declares 4.7.0 and no v4.7.0 tag exists" — that is the guard working.