v0.2.15

fix: explain sensitive-path owner authorization requirements (#87)

Sensitive-path policy failures previously said only that current-head owner authorization was missing. Explain why authorization is required, list up to ten matching changed paths (including rename sources), and tell the owner to post /approve for the current head after rebases or force-pushes. Authorization and exemption decisions are unchanged; matching paths reuse one compiled glob set.

Extend the existing rename regression and scratch authorization probe to check the explanation. Prepare runtime version 0.2.15. Validation evidence will be added after candidate testing.

Validation:
- 25 focused request tests passed; extended the existing rename regression (one live API test remains opt-in).
- Independent review passed, including unchanged short-circuit marker lookup and safe bounded path reporting.
- [Required CI](https://github.com/civitaspo/securefix-server/actions/runs/38530544763) passed formatting, tests, Clippy and workflow checks for `f79be5a1a28424bf98bba6ccfe5695564d32b371`.
- [Candidate prepare](https://github.com/civitaspo/securefix-server/actions/runs/38530562181) passed in testing-securefix-server, including actual sensitive-path rejection with the new reason and /approve instruction, exemption acceptance, client artifact smoke test and fixture creation. Scratch PRs #122–#124 were closed and their branches removed after collecting evidence. Unrelated verify-phase merge/release scenarios were not rerun for this message-only change.
- Initial CI found clippy::collapsible_if; the nested condition was converted to an equivalent short-circuit let-chain before final verification.