The declared range moved to ^1.5.0 with the agent-signature and actor-attribution
work; the lockfile still resolved 1.4.x, so a clean install could not satisfy it.
Lockfile only: the package tarball repacks byte-identical to the validated
candidate.