Workflow 2.15.2

Host bridge signals and updates now deduplicate inside the instance writer lock. A bounded identity token preserves the complete adapter, action, opaque provider key and target tuple, while accepted legacy receipts remain reusable. Conflicting retained metadata fails closed.

Ordinary signal request IDs and service-call identities keep their existing behavior. Host-created identity objects cannot be forged by JSON context or serialized into application payloads. This patch adds no schema migration.

Validation: full ECS/PHPStan; 5,119 unit tests / 72,539 assertions; PostgreSQL feature suite 2,513 cases / 24,675 assertions; 77.21% unit line coverage. Normal published-package/platform and supported Laravel upgrade verification passed in run 40481078834. Merge 15ac2f1ccd5a2e4944bf39c31562d66a62a9d333 has the exact qualified PR #949 tree; Packagist source/dist resolve to that immutable release.

Server consumers require a separate dependency update, image publication and installed acceptance. See durable-workflow/server#777 for that follow-through.