Release v0.15.0

Highlights

• Snapshots become a content-addressed history rather than a single blob.
  commit/checkout store a session as deduplicated objects, so a fork or an
  incremental save costs only what changed. Adds SnapshotGraph for ancestry,
  diffs, reachability, and lazy fetch planning, plus a CheckoutPolicy
  capability gate that refuses to restore a session into an environment missing
  builtins or features it needs. Available from Rust, Python, and JavaScript
  (#2223).
• Bashkit now ships a native C API. Five platform archives expose a
  versioned libbashkit ABI with opaque handles, binary-safe VFS access,
  explicit ownership, runnable C examples, and SHA-256 checksums
  (#2238).
• One-shot CLI execution now behaves like a real shell invocation. Script
  arguments populate $0 and positional parameters, piped stdin reaches the
  script, and stdout/stderr stream before completion or resource-limit failure
  (#2234).
• Path expansion and malformed substitutions are safer and more compatible.
  Globs expand every path component, while invalid $(...) syntax now fails
  closed instead of inventing a command name for permission analysis
  (#2232,
  #2231).
• Arithmetic side effects no longer panic at 64-bit integer boundaries.
  Compound assignment and prefix/postfix increment and decrement now wrap with
  Bash-compatible integer semantics in both evaluator paths.
• Static analysis rejects malformed literal boundaries. Source bytes
  reserved as internal lexer/expansion sentinels and unterminated quote segments
  now fail analysis instead of being normalized into a command name that was
  not present in the script. Analysis also rejects malformed heredoc
  reinjection that inserts command-name characters. Script execution retains
  its existing control-byte behavior.

Breaking Changes

• Bash::snapshot() now writes the v2 content-addressed container. Existing
  snapshots still restore, but snapshots written by 0.15.0 require Bashkit
  0.14.5 or newer. Upgrade rollback targets to 0.14.5 before producing v2
  snapshots; re-snapshot before rolling back further. Future readers get the
  typed SnapshotTooNew { required, supported } error when an upgrade is
  required.
• Snapshot restore now checks runtime capabilities. restore_snapshot
  defaults to CheckoutPolicy::Superset; a runtime missing a builtin, feature,
  or filesystem capability recorded by the snapshot rejects it. Use
  restore_snapshot_with_policy(..., CheckoutPolicy::Force) only when the host
  deliberately accepts that mismatch. Removing or renaming a builtin can make
  older snapshots fail this check.
• Two typed snapshot errors were added to the exhaustive bashkit::Error
  enum. Rust callers that exhaustively match Error must handle
  SnapshotTooNew and SnapshotCapabilityMismatch.

What's Changed

• feat(c-api): add native C ABI (#2238) by @chaliy
• fix(deps): resolve Dependabot vulnerabilities (#2235) by @chaliy
• feat(cli): script arguments, stdin forwarding, and streaming output for one-shot mode (#2234) by @chaliy
• fix(glob): expand every path component, not just the trailing one (#2232) by @chaliy
• fix(parser): reject a malformed $(...) instead of splicing its literals (#2231) by @chaliy
• feat(snapshot): write v2 and expose the history API (#2223) by @chaliy

Full Changelog: v0.14.5...v0.15.0