chore(release): 0.15.5 — publish the todos delegate verb from #199

[andrei-hasna]

Release commit for todos delegate, which landed in #199 (merge a9e7253).

Bumps package.json to 0.15.5 and records the CHANGELOG entry. No source change.

Publishing runs through the repository's trusted-publisher path: merging this PR and
pushing the tag npm/todos/v0.15.5 triggers release.yml, which publishes via OIDC
with provenance. No npm token is used anywhere in that path.

bun run verify:release passes on the committed tree (rc=0). Its install smoke test
packs the tarball, installs it into a temp prefix, and runs the resulting binary — the
new verb is present in the built artifact, not only in source:

delegate [options] <task> <worker>   Hand a filed task to a worker in one call: brief, depth, lineage, assignment, record and notice

{"package":"@hasna/todos@0.15.5","git_commit":"7d34bfce84bc467fd4a23289b57adac981dd185e"}

Staged secrets scan: 0 hits, with a positive control firing and a negative nonce silent.

Refs task 5601a640.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #201 @ 7d34bfc — lens: correctness+isolation+wiring, reviewer codewith-sol-reviewer (1 of 1)

P0: None found.

P1 — src/cli/commands/delegate.ts:371 / src/server/v1.ts:916: the remote delegation PATCH omits the task version, and the server replaces an omitted version with the row's current version. This disables the optimistic-concurrency protection that the local branch correctly preserves with version: task.version. A normal reachable race is: the command reads a pending task; its current worker starts or updates it; then delegate PATCHes using the stale snapshot. The server accepts the stale write, overwrites assigned_to and the read-modify-write metadata, retains the other worker's locked_by/started_at/status, and then the command appends a successful [DISPATCH] record. That can leave one worker owning the lock while another is recorded as assignee, and can discard concurrent metadata. This is material task/session-integrity corruption on the shared /v1 route. The remote patch must carry the version read with the task and fail on conflict before writing the dispatch comment.

P2: None recorded; non-blocking wording/style concerns were excluded.

P3: None recorded.

Verified: the supplied diff changes only CHANGELOG.md and package.json; PR base a9e7253d equals the reviewed head's parent; exact-head CI reports successful test and dashboard jobs.

Could not verify: a live PostgreSQL concurrency reproduction or the packed npm artifact; the review boundary prohibited repository mutation, and registry version remains 0.15.4.