v0.15.0

Added

• get_pr_checks watches a deploy: ref (tag/branch/sha), bounded wait_for_checks, and log_match to confirm a line (e.g. a migration) appeared in the run's log (#362)
• OKFFS_SYNC_BACK=true: promote_branch syncs the protected branch back into the base branch (main → develop) with a true merge commit — never squash — under the merge gates, and verifies it has 2 parents (#361)
• commit_and_update infers the issue branch from a checked-out {issue}-… branch (or a new explicit branch param) when the issue has no Branch: line, and backfills the line — the same evidence create_pull_request trusts (#304)

Changed

• npm publishing now uses Trusted Publishing (GitHub OIDC) instead of an expiring NPM_TOKEN secret (#329)

Fixed

• Changelog fragment type now comes from the issue's native Type and labels (security → Security, Bug → Fixed, Feature/enhancement → Added) before title keywords (#359)