v5.15.1

A patch release carrying two fixes, plus doc/tooling cleanup.

Security

• #891: run-state file paths are now built from a validated id. graph_id, snapshot_id and a workflow run_id named a <id>.json/.pkl file under a run-state root with no validation, so a traversing id (../x) escaped the directory. graph_id reached this from guest .nd code via resume_workflow(id) — reading or deleting a .json outside the state dir; the snapshot id arrived over the server's /restore and DELETE /snapshot/{id}. A single safe_state_id in state_paths.py now gates every run-state path builder, and read/delete entry points treat an invalid id as "not found", so a traversing id is indistinguishable from an unknown one. Filesystem, network and subprocess access were already denied; this was confined to .json/.pkl state.

Fixes

• #893: nodus-lang works on its declared Python 3.10 floor. project.py did a bare import tomllib (stdlib only from 3.11) while its sibling user_config.py had the tomli fallback, and tomli was not even a dependency — so importing nodus failed on 3.10 by either path, though requires-python claims >=3.10. project.py now shares the guard, tomli is a dependency for python_version < "3.11", and a py310-floor CI job imports and runs on 3.10 so the floor is tested.
• The docs now agree on 36 companion packages, and name PyJWT (not python-jose) as nodus-auth's JWT dependency.

Tooling

• Plain pytest now runs tests/closed_issues/. Two rotted tests were repaired, and the companion-count check now reads all of docs/.

PyPI: https://pypi.org/project/nodus-lang/5.15.1/

Full changelog entry: CHANGELOG.md.