v0.4.15

Security

• End-to-end threat model audit, evidence-based. STRIDE walk over
  the running v0.4.15 surface. Findings: 0 P0, 1 P1 (JWT alg
  whitelist — confirmed sound: RS256/RS384/RS512/ES256/ES384 only,
  no HS256, no none; algorithm-confusion attack not possible),
  2 P2 (metrics-key rotation guidance, DNS-rebinding default-off
  rationale). Updated SECURITY.md with explicit subsections
  documenting each: JWT algorithm whitelist (cited at
  app/auth.py:90-98), /internal/metrics token management and
  what the endpoint exposes, anonymous-mode + 0.0.0.0-bind
  residual risk by deployment topology. Added a "Threat model
  audit log" section so each minor release carries a dated audit
  pass for downstream auditors.

Fixed

• Installer detection check no longer trips tests / IaC that pass
  an explicit config_path. v0.4.13 added skip-when-client-not-
  detected logic that fired even when a caller passed
  config_path= explicitly — including the test suite, which
  CI-runs on Linux runners with no IDE installed. Five
  test_claude_code_* cases regressed on CI for v0.4.14 (assert 'skipped' == 'added'). Now every install_* short-circuits the
  detection check when an explicit config_path is provided —
  caller-knows-best wins over auto-detect. --force still works
  for the no-explicit-path case (provisioning the default location
  on a host that doesn't have the IDE yet). _client_not_detected_skip
  docstring updated to spell out the contract.