v1.15.0 — Catalog refresh and operator readiness

Adds a bounded per-source refresh CLI that reuses B3/B4 acquisition and atomic promotion. Structured changes can promote automatically; fetched reports remain separate immutable bytes until a human reviews the exact hash against an accepted snapshot. Failed/unchanged feeds keep last-good evidence, and lock contention skips without fetching or advancing freshness.

Operators can reverse the active snapshot with a source-bound immutable audit. Opt-in /metrics reads durable check state in one bounded query and distinguishes missed successful checks, failures, pending review, snapshot age and publication age. Refresh state is separate from local manifest imports so those cannot mask upstream failures. Defaults do not start a scheduler or enable metrics.

Migration b16c0a7a0001 follows a0b1c2d3e4f5, preserves populated catalog data, validates exact report bytes and protects operator history. Populated downgrade refuses before DDL. Existing import CLI behavior, catalog/runtime independence, unresolved aliases and agent contracts remain compatible.

Validation: Full final fake backend/agent suite on PostgreSQL 16: 1,216 passed, 40 opt-in skips, with the existing Starlette test-client deprecation warning. Final importer/refresh suite: 188 passed. Wheel build and importer/B3/B4 packaging checks, focused Bandit, static checks and self-review passed. No production imports/migrations, paid calls, runtime/rate activation or deployment. The companion GitOps chart is disabled/suspended and outside watched Applications.

Release: 1.14.0 -> 1.15.0 (MINOR) for compatible new operator and monitoring functionality. No agent release is needed: agent execution/config/result contracts are unchanged. Publish the reviewed main commit and verify anonymous GHCR pull/OCI labels; publishing does not change deployment pins.