Release v15.38.1

Summary

Two read-model [PII] compliance fixes.

Reducer [PII] collection freeze. A coarse [PII] on a whole collection blob-encrypts the list to a single ciphertext string at rest. On read, the compliance release step decrypted it but left it as a raw string, so a reducer failed to deserialize its own stored state on the next event and the read model froze at its first-event value. The released value is now re-parsed back into the array its schema expects, so it round-trips into the read model's collection type — for reducers, projections, query-time serving, and passive command-side reads alike.

[PII] child not removed. Removing a [ChildrenFrom] child that carries a [PII] member silently left it in place on the MongoDB sink: the $pull matched by whole-document equality against the plaintext removal state, but the stored child's [PII] member is encrypted at rest, so nothing matched. Object children are now pulled by their identifier, matching the in-memory sink.

The projection AutoMap collision this branch initially also tried to fix needs a different, opt-in mechanism — a scope-wide "explicit beats implicit" rule breaks the pervasive create-then-rename pattern (a property [SetFrom] by a rename event must still AutoMap from the create event). That change was reverted; the collision is tracked in #3444.

Fixed

• A read model whose property is a [PII] collection no longer freezes its reducer: the encrypted list is released back into an array that deserializes into the read model's collection type instead of failing as a raw string.
• Removing a [ChildrenFrom] child that carries a [PII] member now removes it from the MongoDB read model instead of silently leaving it in place.