chore(release): v0.7.33

[argszero]

Summary

Release v0.7.33. Bumps the declared version in the manifest and the three deployment carriers (Cargo.toml, Cargo.lock, Dockerfile, docker-compose.yml) and records the release at the top of CHANGELOG.md.

Exactly one commit landed on main since v0.7.32: #409 (docs(retention): retire the list premise both retention gates state) — a comment-only change to the two retention gates that still stated a premise #406 had retired. No schema change (still 16); no behaviour change.

Related Issue

None.

Changes

• Cargo.toml / Cargo.lock / Dockerfile / docker-compose.yml: 0.7.32 → 0.7.33
• CHANGELOG.md: new ## v0.7.33 (2026-10-15) section
• No configuration or data-structure change (the example config is untouched)

Tests

• cargo test — 562 passed / 0 failed, the same count as v0.7.32 (the diff is version strings and prose)
• cargo fmt --check — rc=0
• cargo clippy --all-targets -- -D warnings — rc=0
• No new test: a release commit carries no new behaviour. The two version gates that do have teeth both pass on this tree — deploy_gate::the_deploy_artifacts_carry_the_version_the_manifest_declares and deploy_gate::the_changelog_heading_carries_the_version_the_manifest_declares.

Checklist

• Branch name follows the convention (chore/)
• Commit message uses Conventional Commits (chore(release): v0.7.33)
• Single responsibility, minimal diff (5 files, +15/−7)

After merge

Tag v0.7.33 on the merge commit and push the tag. docker-publish.yml refuses a tag that does not match the version Cargo.toml declares, so the published image and the manifest stay pinned together.