chore(release): prepare MCP 1.0.15

[escott-]

Bumps the workspace, npm package, MCP Registry metadata, and the boundary self-test to 1.0.15, and adds the 1.0.15 changelog covering the one commit on main since v1.0.14:

• 3c99506 resume and resume_list now exclude the session id the API assigned at init. The 1.0.14 exclusion did not work in production when the caller passed no session_id: the server kept a random local id while the API stores snapshots under the id it returns from init, which was never read.

No dependency changes: Cargo.lock differs from 1.0.14 only in the seven workspace package versions (anstyle is a third-party crate that happens to sit at 1.0.14 and is untouched).

Verification

On ovh-desktop, against main 3c99506 plus this change:

• cargo fmt --all --check
• cargo clippy --locked --workspace --all-targets -- -D warnings
• cargo test --locked --workspace --all-targets: 2961 passed, 0 failed (2958 before, plus the 3 new tests from the fix, including resume_after_a_real_init_never_offers_the_session_the_api_just_opened)
• account_connection_smoke.py against the built binary: 9 tests
• cargo audit --deny warnings and cargo deny --locked check: clean

On a clean copy of the tracked files: public_boundary.py, release_contract.py resolve-version for v1.0.15, the release-contract, boundary, DCO, workflow, grounding and adoption script tests, and npm test (6/6).

No macOS-only code changed in this release, so no separate macOS gate was run; the darwin release builds compile the whole crate.

Not verified: the fix against production. After installing 1.0.15, a fresh session calling session(action="resume") with no arguments should return the previous session, not itself.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}