pakka v0.15.1

Patch release. spec-generate now anchors output to the git toplevel and refuses to write outside a repo (--repo-root to override) — previously CWD-relative, which could silently file a spec into a sibling repo. Compaction survival: investigated PostCompact re-injection and rejected it (CC 2.1 discards PostCompact output); the working mechanism — SessionStart firing with source compact, already matched by pakka's hook — is now pinned by a regression test so it cannot be narrowed unnoticed. Assets CI-built with SLSA provenance attestation, SHA256SUMS, CycloneDX SBOM.