Catch-up: sync missing v1.5.8 + v1.5.9 changes to public repo

[dayyanj]

What / why

PRs #3 and #4 landed the OSS-side transitions but silently dropped 8
files during their sync + branch + commit flows. shop/main at
v1.5.9 has always had the correct content — the public tree has
been running stale.

Impact: the public repo has claimed to be v1.5.9 in its Release
notes since the v1.5.9 tag was cut, but the CHANGELOG.md still
shows v1.5.7 at the top, core/version.py still says 1.5.7, and
several v1.5.9 bug fixes are simply absent (storefront add-to-cart
500, guest wishlist 401, admin help search 500, POS parked-cart beat
schedule).

How

Copied 8 files verbatim from git archive shop@v1.5.9, the same
source the earlier syncs should have used:

• CHANGELOG.md — restores v1.5.8 + v1.5.9 entries
• core/version.py — 1.5.7 → 1.5.9
• cart/models.py (+51 lines), cart/views.py (+12 lines) —
  v1.5.9 storefront regression fixes
• core/api/help_views.py, core/services/semantic_search.py —
  v1.5.9 admin help search 500 fix
• core/settings.py (+15 lines) — v1.5.9 parked-cart cleanup
• core/fixtures/help_embeddings.jsonl.gz — regenerated embeddings
  for backfilled help topics

Sync-script blocklist rules unchanged; no forbidden strings surfaced.

Root cause of the earlier drops is under investigation — likely a
race in sync-to-open + branch + commit that reset the working tree
back to origin/main state after the sync rsync'd new content. A
harder-to-corrupt sync flow will follow.

Test plan

• Explicit file-by-file diff between shop@v1.5.9 and public main
  HEAD — only these 8 files differ
• No missing new files (Only in scratch = 0)
• No extra files on public (Only in target filtered to .git only)
• Files copied verbatim — no re-typing, no manual edits

Local tests already ran against these files at v1.5.8 / v1.5.9 tag
time (166 tests pass); CI will re-verify on this branch.

Checklist

• Every commit is signed off (git commit -s)
• Docs updated (that's the whole point — CHANGELOG catch-up)
• No new inline <style> or <script>
• No hardcoded paths or IPs
• No accidental secrets

Screenshots

None.

Related issues

Follow-up post-mortem needed on the sync workflow so this doesn't
recur.