Release v0.1.5 - Harden update flow · Interplay-Design/interplay-services

Fixes fatal errors in the self-update flow that caused the previous v0.1.4 release to break theme/plugin update transients.

Highlights

Drop strict \stdClass type hints from filter callbacks (pre_set_site_transient_update_*, themes_api, plugins_api); guard with runtime type checks. Non-stdClass values from core/other plugins no longer TypeError.
Plugin::boot() and UpdateManager::register_hooks() are idempotent — safe under self-update reactivation, where WordPress re-includes the plugin bootstrap in the same request.
Defensive constant defines and require_once across the bootstrap and autoloader.
GitHubReleasesSource caches plain arrays instead of UpdateResult instances, so changes to the result class shape can no longer poison cached transients.
Client::is_github_url() uses exact-host / proper-subdomain matching (was matching evilgithub.com); adds codeload.github.com and objects.githubusercontent.com for redirect targets.
DownloadProxy stamps the proxied URL on each download and feeds it into upgrader_source_selection so the slug resolver can map the extracted folder back to product metadata reliably.
Cleans up temp file on every download error path; verifies the streamed download is non-empty.
Adds missing requires/requires_php keys to theme update entries.
Bumps Requires PHP header to 8.1 to match readonly/promoted-constructor usage.

The v0.1.4 release ships pre-fix code and should not be installed.