chore(release): prepare MCP Proxy 0.7.21

[oleg-bk]

Summary

Stage 0 release hygiene for MCP Proxy 0.7.21 after Workflow Guard cleanup.

• Bump aligned agentveil and agentveil-mcp-proxy versions to 0.7.21.
• Update 0.7.21 changelog notes for TrapDoor P0 hardening plus the PR MCP Proxy onboarding and Approval Center foundation #60 onboarding / Approval Center foundation.
• Update the MCP Proxy release-acceptance wheel example to 0.7.21.

Boundary

No tag, publish, release workflow, or VPS action is included.

Workflow Guard is not part of this MCP Proxy release path. PR #62 removed it from packages/agentveil-mcp-proxy.

Approval Center content in this release is foundation-only for dogfood. This does not claim a production-ready persistent Approval Center lifecycle.

Verification

Local hygiene checks on this branch:

PYTHONPATH=. /Users/olegboiko/Desktop/avp-sdk-public/.venv/bin/python - <<'PY'
import tomllib
from pathlib import Path
import agentveil
root = tomllib.loads(Path('pyproject.toml').read_text())['project']['version']
proxy = tomllib.loads(Path('packages/agentveil-mcp-proxy/pyproject.toml').read_text())['project']['version']
assert root == proxy == agentveil.__version__ == '0.7.21'
PY

Result: version sources synchronized to 0.7.21.

rg "workflow-guard|WorkflowGuard|workflow_guard" packages/agentveil-mcp-proxy

Result: no matches.

Previously completed gates:

• TrapDoor P0 installed-candidate VPS gate passed on 55da7e9, not from PyPI.
• PR MCP Proxy onboarding and Approval Center foundation #60 onboarding / Approval Center foundation merged at 6dff73331641c6ebc96eaacdcca9818c95131249 after CI and VPS user-path acceptance.

Follow-up after merge

Run final release acceptance on the current 0.7.21 RC wheel, then request explicit operator approval before tag/publish.