fix: sync npm package version and prevent root publish

[lacymorrow]

Summary

• Root cause: Releases v1.8.12-v1.8.15 were published from the repo root instead of packages/lacy/, so the published npm package had no bin field, causing npx lacy to fail with "could not determine executable to run"
• Fix: Sync packages/lacy/package.json version to 1.8.15, update bin/lacy VERSION_FALLBACK, and add "private": true to root package.json to prevent accidental root publishes in the future
• After merge: A new release (v1.8.16) must be published using bun run release so the npm package gets the correct bin field from packages/lacy/

Fixes LAC-2055. Related: LAC-1963.

Test plan

• Merge this PR
• Run bun run release patch to publish v1.8.16 from the correct directory
• Verify npx lacy works: npm view lacy@latest bin should show { lacy: "index.mjs" }
• Verify npm publish from root fails with "private" error (safeguard)

[gemini-code-assist]

Code Review

This pull request updates the project version to 1.8.15 across several files, including the shell script fallback and package manifests, while also marking the root package as private. Feedback identifies that the package-lock.json was previously significantly out of sync with the package version, suggesting that the release automation script should be updated to ensure lockfiles are correctly synchronized during future releases.

[gemini-code-assist]

The lockfile was significantly out of sync with the package version (1.7.2 vs 1.8.11). This suggests that the release automation in script/release.ts is manually updating package.json files but omitting the corresponding package-lock.json updates. To prevent future drift, the release script should be updated to either use npm version or explicitly update and stage the lockfiles during the release process.