release: harden and publish Hermes Chutes Provider v0.1.5

[TheStreamCode]

Summary

• Bound and validate live Chutes catalog responses while preserving routing aliases, frozen provider identities, optional-field compatibility, and fail-soft behavior.
• Harden CI with Python 3.14 coverage, refreshed commit-pinned Actions and Hermes integration, checkout credential isolation, timeouts, and contract tests for SHA pinning.
• Improve the public GitHub presentation with an immediate support-status summary, compact architecture diagram, structured Issue Forms, private vulnerability reporting guidance, and a custom social-preview source asset.
• Prepare Hermes Chutes Provider v0.1.5 by synchronizing package, plugin, citation, changelog, tests, issue forms, and stable-install documentation for the real 2026-08-09 release date.

PR #5 was reviewed through its own green CI and squash-merged into this branch so one protected human approval on this final PR covers the complete v0.1.5 release diff.

Audit findings

• AUD-001 — Medium — Resolved: the catalog probe previously read an unbounded response body. It now caps reads at 8 MiB and fails soft on oversized or malformed payloads.
• AUD-002 — Medium — Resolved: CI checkouts previously persisted credentials and used older action pins. Credentials are no longer persisted, action and Hermes pins are refreshed, and timeouts are explicit.
• AUD-003 — Low — Resolved: manual installation previously cloned moving main. Stable commands now clone v0.1.5, with main documented only as a development route.
• AUD-004 — Medium — Resolved administratively: main requires the 3.11 and 3.14 offline gates, Hermes integration, and aggregate CodeQL with checks bound to their GitHub Apps; admin enforcement and Actions SHA pinning are enabled.
• No critical or high-severity findings remain in the audited scope.

Validation

• python -m unittest discover -s tests -v
• Offline suite passed locally on Python 3.11, 3.12, and 3.14
• Hermes integration passed in CI
• Wheel and sdist built in isolation and passed Twine checks
• Wheel contains LICENSE and NOTICE and excludes tests, GitHub assets, credentials, and caches
• CITATION.cff validates against CFF 1.2.0
• Plugin, citation, workflow, and Issue Form YAML files parse successfully
• Gitleaks found no secrets
• GitHub CodeQL reported no open alerts before the release preparation

Compatibility and Security

• No credentials, secrets, or private data are included
• Hermes Agent and Chutes compatibility claims were verified
• Provider identity, aliases, environment variables, public exports, and both install entry points are preserved
• No static concrete model IDs or live paid inference were introduced

Distribution remains GitHub Releases only. This repository is a Python Hermes provider plugin and has no VS Code extension manifest or VSIX artifact, so no VSIX update applies. After the required human approval and protected merge, tag the merge commit v0.1.5 and publish the verified wheel and source distribution.