chore(release): prepare v0.15.0

[mbeacom]

What and why

Prepares v0.15.0. This covers docs/RELEASING.md "Subsequent releases" steps 1–4, and follows the v0.14.0 prep commit (#213) file for file: the same 20 files.

It's a minor release carrying a breaking change, which ADR-0002 allows before 1.0: ADR JSON Schema v0.2.0 requires seconds in date-time fields (#241). v0.1.0 is still served byte for byte.

Highlights (full notes are in the CHANGELOG [0.15.0] section):

• Changed:
  • Schema v0.2.0 (BREAKING; the fix is to append :00 to minutes-only timestamps).
  • MCP SDK 2.1.0 on both protocol eras. The server now exits on stdin EOF (ADR-0018 amendment).
• Security: gate-change-acknowledged counts only when an admin or maintainer applied it (ADR-0042).
• Added: the regenerate-artifacts label for Dependabot PRs (ADR-0041), and the check:stale-refs guard.
• Fixed: the yaml declared range, and 0.14.0's zod/schema mismatch.

Changes in this PR:

• Step 1, versions: 0.15.0 in @adrkit/{cli,core,evaluator,mcp}, the root, CLI_VERSION, SERVER_INFO, and both version fields in packages/mcp/server.json.
• Step 2, bun.lock: the four packages/* version fields were edited directly, giving exactly a four-line diff. bun install --frozen-lockfile accepts it, and release:pack validates the packed manifests through it.
• Step 3, badges: @adrkit/cli@0.15.0 pinned in site/src/content/docs/badges.mdx. check:doc-pins passes.
• Step 4, current-release wording:
  • Updated: the site hero, index, quickstart and ci pages, README, RELEASING, AGENTS.md, and the bug-report placeholder.
  • Left alone: historical mentions, docs/reference-verification-spec-kit-extension.md (it refers to Spec Kit's own 0.14.0), and the example strings in check-stale-adr-references.
• CHANGELOG: [0.15.0] - 2026-09-28 is cut, with compare links. Two Fixed entries were rewritten to describe what actually ships: the temporary zod cap (fix(deps): cap zod below 4.5 until schema v0.2.0 (#235) #236) never ships, and the bundles carry yaml 2.9.1 (build(deps): Bump yaml from 2.9.0 to 2.9.1 #237).

Checklist

• DCO signed off.
• ADR / schema / packages/ci/dist — n/a. dist and schema are unchanged from main.
• Verified locally on Bun 1.3.14:
  • typecheck, build and lint pass.
  • The checks clean-clone, deps, changelog, stale-refs, doc-pins, site-grammar and freeze-hashes pass.
  • release:pack prepared 5 packages for v0.15.0.
  • bun test: 3168 pass, 0 fail.
  • smoke-node passes on both MCP protocol eras.
  • emit:manifest produces no diff.

Notes for reviewers — after merge, maintainer steps (RELEASING 6–12)

1. git tag -a v0.15.0 -m "v0.15.0" <merge commit> && git push origin v0.15.0. The tag must be annotated.
2. Approve the protected npm environment deployment. Confirm all packages published and a draft release was created. v0 must not move yet.
3. Publish the draft with Publish this Action to the GitHub Marketplace, choosing Code review as the primary category and Code quality as the secondary.
4. Confirm Publish container moved v0 and published ghcr.io/mbeacom/adrkit:v0.15.0. Add the Marketplace completion note to the release notes.
5. cd packages/mcp && mcp-publisher publish. No workflow does this.
6. Post-release checks:
   • ADR-0018: repeat the Inspector run against the published @adrkit/mcp@0.15.0 on both eras.
   • ADR-0043: confirm https://adrkit.dev/schema/adr/v0.1.0/adr.schema.json still hashes to 1e184115… and that v0.2.0 is served at its $id.

Between merge and tag, the site will claim v0.15.0 before the tag exists. That window is expected (see RELEASING).

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved review issues were identified, and all approval-readiness assessments support approval.

Review effort: Lite
Findings: None

What changed in this PR

Prepares the coordinated v0.15.0 release across package metadata, documentation, lockfile, and release notes.

Changes:

• Synchronizes package and runtime versions.
• Updates release documentation, site references, badges, and issue templates.
• Adds v0.15.0 changelog notes and comparison links.

File	Description
site/​src/​content/​docs/​quickstart.mdx	Updates current release label
site/​src/​content/​docs/​index.mdx	Updates published version
site/​src/​content/​docs/​ci.mdx	Updates Action release references
site/​src/​content/​docs/​badges.mdx	Updates CLI pins
site/​src/​components/​Hero.astro	Updates hero version
README.md	Updates release references
packages/​mcp/​src/​server.ts	Updates server identity version
packages/​mcp/​server.json	Updates MCP registry metadata
packages/​mcp/​package.json	Bumps MCP package version
packages/​evaluator/​package.json	Bumps evaluator version
packages/​core/​package.json	Bumps core version
packages/​cli/​test/​color.test.ts	Updates version expectation
packages/​cli/​src/​index.ts	Updates CLI version
packages/​cli/​package.json	Bumps CLI version
package.json	Bumps repository version
docs/​RELEASING.md	Updates release documentation
CHANGELOG.md	Adds v0.15.0 release notes
bun.lock	Aligns workspace versions
AGENTS.md	Updates project status
.github/​ISSUE_TEMPLATE/​bug_report.yml	Updates version placeholder

[github-actions]

Decisions governing this change

• 0003 — Ship as a Spec Kit extension plus a standalone CLI, not a competing harness
  • via path: packages/cli/**
• 0007 — Isolate integrations as optional adapters and build only against public surfaces
  • via path: packages/*/package.json
• 0010 — Use Bun as the package manager and test runner while publishing Node-targeted artifacts
  • via path: package.json
• 0011 — Host the canonical JSON Schema at its $id on adrkit.dev
  • via path: site/**
• 0016 — Require every check to be observed failing before it counts as coverage
  • via path: packages/*/test/**
• 0017 — Keep dependency audit scope explicit and release-scoped
  • via path: packages/*/package.json
• 0018 — Adopt MCP SDK v2 and serve protocol revision 2026-07-28 dual-era
  • via path: packages/mcp/**
• 0022 — Scan inbound markers in check and CI without giving them exit-code authority
  • via path: packages/cli/src/index.ts
• 0024 — Report the measured scan extent, not the window constant
  • via path: packages/cli/src/index.ts
• 0025 — Ship badges as recipes over existing output, not a new CLI surface
  • via path: package.json
  • via path: site/src/content/docs/badges.mdx
• 0026 — Identify the CI comment by the strongest author evidence the token allows
  • via path: site/src/content/docs/ci.mdx
• 0027 — Ratify the deterministic evaluator and bind calibration reporting to the first probabilistic pass
  • via path: packages/evaluator/**
• 0029 — Scope Backstage publication as a downstream consumer, tiered on the entity-ownership mapping
  • via path: packages/cli/src/index.ts
• 0030 — Keep extension surfaces that carry a dependency tree outside this repository
  • via path: package.json
• 0031 — Publish a narrow consumer SDK as the contract, and document the CLI JSON as its sibling
  • via path: docs/RELEASING.md
  • via path: packages/cli/src/index.ts
• 0032 — Publish one lockstep OCI image after the coordinated release succeeds
  • via path: README.md
  • via path: docs/RELEASING.md
• 0033 — Select interactive graph presentation at the CLI boundary while preserving piped DOT
  • via path: packages/cli/src/index.ts
  • via path: site/src/content/docs/**
• 0036 — Expose the governing-decisions Action through one root Marketplace entry point
  • via path: docs/RELEASING.md
• 0037 — Treat generated knowledge systems as downstream read models, not decision authorities
  • via path: README.md
  • via path: site/src/content/docs/**
• 0038 — Offer the bootstrap decision record as an offer rather than a backfill candidate
  • via path: site/src/content/docs/quickstart.mdx
• 0039 — Derive a valid-time window from date and supersession, and resolve a git ref at the CLI boundary
  • via path: packages/cli/src/index.ts

Active proposals touching this change

These are not yet ratified and do not bind this change:

• 0040 — Keep derived surfaces in lockstep with three mechanisms matched to three classes of drift (proposed)
  • via path: AGENTS.md

Historical records that once covered this change

These no longer bind this change, and are listed for context only:

• 0005 — Gate proposals with a deterministic-first evaluator and declarative escalation (superseded) — superseded by 0027
  • via path: packages/evaluator/**
• 0021 — Resolve inbound source annotations without changing the schema (superseded) — superseded by 0022
  • via path: packages/cli/src/index.ts