0.15.1 — pinned join bootstrap + CI

• Security: invite bootstrap blocks now download mesh.py pinned to the inviting node's release tag (v<VERSION>) instead of the tip of main, so a bad or malicious push to main cannot break or compromise future joins.
• GitHub Actions CI: the unittest suite runs on Linux and macOS across Python 3.8–3.13 (Windows observational — #48), a consistency job keeps mesh.py/pyproject.toml/plugin manifest versions in lock-step, and a gitleaks job scans full history for leaked secrets on every push.
• PyPI publish workflow (trusted publishing, runs on GitHub release).
• Docs: list mesh_delegate in the MCP tools roster.