Prepare Python SDK for public release

[JJasonSun]

Summary

• Clarify that MIT covers the published calle-ai 0.6.0 and 0.7.0 distributions, and remove a non-public environment hostname from contributor docs.
• Prevent credential exposure in generated client representations, keep call IDs in one URL segment, and bound the local webhook example resource usage.
• Lock Hatchling and Twine in the release validation path.

Checklist

• I kept this change within the supported server SDK scope.
• I did not add browser/client-side patterns that expose CALL-E API keys.
• I did not include private collaboration links or unconfirmed public repository references.
• I updated tests, examples, or docs when behavior changed.
• I updated the changelog when the change affects package users.
• I ran the relevant local checks.

Local checks

bash scripts/validate.sh

Passed: 51 tests, Ruff, mypy, OpenAPI and public-repository checks, wheel and sdist builds, Twine validation, artifact verification, and fresh package-install smoke tests.

This PR does not publish a package.