GRM-65: fix: pin devx to v0.4.0, fix cliff.toml preprocessor, bump to v0.7.0

Makefile

@@ -7,11 +7,15 @@ CHECKMAKE := $(shell command -v checkmake 2>/dev/null || echo $(HOME)/go/bin/che
 
 all: setup
 
+# Pinned devx version — update this when upgrading devx.
+# All workflow files (.gitea/workflows/*.yml) must be updated to match.
+DEVX_VERSION := v0.4.1
+
 install-devx: $(VENV)/bin/activate
 	@# REPO_TOKEN may come from .env (local) or environment (CI secrets)
 	@if [ -z "$$REPO_TOKEN" ]; then . .env 2>/dev/null; fi; \
 	if [ -z "$$REPO_TOKEN" ]; then echo "REPO_TOKEN not set (check .env or environment)"; exit 1; fi; \
-	$(BIN)/pip install "git+https://emil:$$REPO_TOKEN@git.oblachno.oblachno.fyi/oblachno-oss/devx.git@master"
+	$(BIN)/pip install "git+https://emil:$$REPO_TOKEN@git.oblachno.oblachno.fyi/oblachno-oss/devx.git@$(DEVX_VERSION)"
 
 # Full setup for local development (all deps, tools, collections, hooks)
 # install-devx must run before install-tools (which uses devx modules)