chore(release): 0.15.0

[svyatov]

What changed

Folds the accumulated Unreleased section into ## [0.15.0] - 2026-08-11, adds its compare link, and bumps version in the three plugin manifests.

Why this way

MINOR applies, and the reason is one entry rather than the release as a whole. R-SEC-09 now counts a repository's workflow files when it establishes which languages an analyzer supports. A repository whose application language no analyzer supports, and which ships workflows, passed 0.14.0 and fails 0.15.0. The README calls that shape incompatible, and below 1.0.0 an incompatible change ships in a MINOR release.

The rule's Check text did not change, and CodeQL has shipped an actions language since April 2025, so the rule always reached those files and oss-harden was answering wrong. That reading makes the change a fix. It does not change the version, because the effect on a repository being audited is the same either way, and understating it is the only error with a cost.

Everything else in the release is skill body wording and references/ content, which the README places outside the version. No rule ID changed what it requires, and no skill was renamed or removed.

Verification

• bun run typecheck
• bun test, 328 tests passed
• bun run validate, 0 errors and 0 warnings
• bash tests/test-check-drift.sh, 12 tests passed
• bash scripts/check-drift.sh
• bun scripts/check-ecosystems.mjs, 11 ecosystems x 7 skills present
• node skills/oss-writing/scripts/prose.mjs CHANGELOG.md, 0 findings
• bun run build in site/, 114 pages

Known gaps

The tag is created after this merges, and tags-immutable makes it unrepointable, so it has to be right the first time.