Release 0.1.15 — containment + hardening + docs

[mvalancy]

Release 0.1.15

Three independently-reviewed batches since 0.1.14.

PR	What
#115 (#112)	realpath-contain findZimFiles() (the kiwix feeder) — completes #101 across all three production symlink-following surfaces (downloads, /api/packages, kiwix).
#116 (#65)	reconcile design/knowledge docs with shipped reality through 0.1.14.
#117 (#88/#89)	pin GitHub Actions to commit SHAs + --all bundle guard; /api/packages filters .part/in-progress + enumerates top-level .gguf.

Plus chore(version): VERSION 0.1.14 → 0.1.15.

Gate

• All three: Gate-1 review + green CI. Gate-2 review: integration + security lenses clean (containment fail-closed on all surfaces, SHA pins verified via API, secrets clean); the sole finding was the pre-tag VERSION bump (this PR).
• Squash-merge (linear history); tag 0.1.15 (unprefixed).

Deferred (0.1.16+)

#69 offline notification center, #95/#96, further #67/#90/#91 slices.

🤖 Generated with Claude Code