Chore: prepare 0.4.15 release

[ivory-code]

Summary

Prepare QAMap 0.4.15 by synchronizing package and plugin versions, documenting the merged static QA and bounded execution improvements, recording the completed release gates, and updating the post-release roadmap.

Behavioral Contract

No new analyzer behavior is introduced by this release-preparation PR. The 0.4.15 package exposes the already merged account-scoped storage, divergent-copy, repository-declared E2E execution, validation-contract preservation, intent-isolation, identifier-boundary, and provider-neutral benchmark behavior under one synchronized version.

The release documentation keeps static QA, generated drafts, repository validation, provider-backed measurement, and executed product QA as separate evidence states. npm publication, Git tagging, the GitHub Release, and any OpenAI directory replacement remain post-merge actions.

Evidence

Closes #219.

Release evidence:

• 412/412 unit and integration tests passed
• 35/35 static recommendation contracts passed
• 10/10 context identity and reuse checks passed
• 3/3 execution contracts passed and caught all three seeded regressions
• the agent benchmark dry-run assertion passed without invoking an external provider
• coverage reached 90.70% lines, 87.15% branches, and 95.99% functions
• plugin metadata validation and isolated package smoke passed
• the 0.4.15 package preview contains 198 files
• npm public publication dry-run passed

Checks

• Focused regression tests
• pnpm test
• pnpm bench:ci
• pnpm bench:agent --dry-run --assert
• pnpm bench:context
• pnpm bench:execution
• pnpm scan
• pnpm plugin:check and pnpm plugin:smoke
• pnpm release:check
• npm publish --dry-run --access public
• Documentation links and commands verified

Public OSS Check

• No private repository, source, path, customer data, credential, or internal smoke output is included.
• Shared inference has unrelated positive and negative coverage, or this is not applicable.
• User-facing commands and claims match actual behavior.

Review Notes

The full release gate passed from the versioned 0.4.15 branch. QAMap static self-analysis correctly kept execution not-run and routed the metadata-only change to repository validation, but selected the general pnpm test command rather than the stronger release gate. The release verdict therefore comes from the repository-owned pnpm release:check evidence above, and the narrower routing gap remains follow-up work.