release: bump version to 0.72.0

CODEMAP.md

@@ -41,11 +41,18 @@ are the source of detail for specific subsystems.
   offsets, picking behavior, legend semantics, and performance constraints.
 - `planet.sh` owns local environment bootstrap and service lifecycle. Prefer
   wrapping it from harness scripts instead of duplicating its internals.
+- Harness scripts source `scripts/harness/lib.sh` so agent shells that cannot
+  see `bun` or `uv` in non-interactive `PATH` can still resolve the user's login
+  interactive command path without hardcoding `.zshrc`.
 
 ## Validation Commands
 
 ```bash
 scripts/harness/doctor.sh
+scripts/harness/security-check.sh
+scripts/harness/backend-rules-check.sh
+scripts/harness/frontend-rules-check.sh
+scripts/harness/docs-consistency-check.sh
 scripts/harness/quick-check.sh
 scripts/harness/validate.sh
 ./planet.sh health
@@ -60,8 +67,17 @@ uv run --frozen --group dev --project .. python -m pytest -s tests/test_api.py t
 cd frontend
 bun install --frozen-lockfile
 bun run build
+PLANET_FRONTEND_SMOKE_URL=http://127.0.0.1:4173 bun ../scripts/harness/frontend-smoke.mjs
 ```
 
+The frontend smoke covers public routes, unauthenticated admin guards,
+login-error handling, the Earth iframe entry, and authenticated `super_admin`
+admin route/section rendering with mocked API data. Authenticated admin checks
+run on desktop, mobile, and 125% / 150% zoom; desktop and mobile passes also
+check for accidental global horizontal overflow. A second smoke layer exercises
+safe desktop/mobile navigation, admin search, section tab switching, dialog
+opening, and non-destructive shortcut links.
+
 Optional delivery smoke, when Docker and Helm are available:
 
 ```bash
@@ -84,9 +100,9 @@ PLANET_HARNESS_DOCKER_SMOKE=1 scripts/harness/validate.sh
 
 ## Known Sharp Edges
 
-- `project_context.md` includes older roadmap-era assumptions such as Celery,
-  Kafka, TimescaleDB, MinIO, and UE5 being part of the active local stack. Treat
-  it as background unless current README/docs/code confirm the same behavior.
+- `project_context.md` is static background for agents. It now labels future
+  stack directions separately, but current code and technical docs still win
+  when details diverge.
 - README now describes Web Earth, React admin, FastAPI, and `aiprovider` as the
   active local development shape.
 - Local `destroy` is intentionally destructive for Planet-owned Docker and build