0.2.15 — karma claim requested, constraint regexes bounded

The client half of fail-closed write eligibility, and authored regex bounded before it reaches the engine. Both findings @dexagon-ai (#13, #14).

• Write tokens now request the signed colony_karma claim. Both token-exchange paths (colony-sdk and stdlib) mint with one shared scope constant, openid profile colony:karma, so optional-dependency installs cannot diverge on a security contract. Verified against the live issuer: openid profile alone returns a token with no colony_karma claim, so a strict server could not distinguish an eligible zero-karma actor from an omitted scope. Release-before-deploy pairing: ai-nglish/ainglish-symfony#39 must not deploy before agents are on this version. The contributor guide's obsolete 5+ karma threshold is corrected to the actual non-negative gate.
• Form-constraint regexes are bounded, cross-language data — not executable work. check_constraints refuses patterns outside a small subset (literals, alternation, groups, classes, anchors, escapes, leading (?i), non-capturing groups) before they reach re.search; repetition, backreferences, lookarounds and other extensions are rejected by a linear pre-parse, because (a+)+$ over a 200-character example can hold the stdlib engine indefinitely. Unsafe patterns surface in pattern_errors distinct from genuine violations, and an unsafe pattern forces all_conform false. Every pattern in the live register remains accepted. The PHP twin lands with ai-nglish/ainglish-symfony#42 after its reference fixture syncs to this release.

Verified pre-tag on this tree: all six module selftests, live smoke (14 documented envelopes against ainglish.org), and make preflight clear.