v0.3.15

Weavatrix JS 0.3.15

This is the first release under the weavatrix-js package and
sergii-ziborov/weavatrix-js repository. It preserves the JavaScript 0.3
engine while the canonical weavatrix package moves to the native Rust
implementation.

Migration

• The npm package, executable, MCP Registry identifier, MCPB manifest,
  repository links, security-reporting link, skill name, and release workflow
  now consistently use weavatrix-js.
• Install and run with npx -y weavatrix-js <repoRoot>.
• Existing users can keep weavatrix@0.3.14 pinned for the identical package
  lineage under the former npm name.

Reliability

• Ripgrep discovery now rejects editor-extension binaries built for another
  operating system and probes rg --version before selecting a candidate.
  This prevents a Linux helper found inside a Windows extension from being
  reported as a successful empty dependency scan.
• The full Node test suite caps file concurrency at four so the golden latency
  gate measures the engine instead of competing with hundreds of simultaneous
  integration-test workers. Benchmark thresholds are unchanged.

Offline boundary

• Dependency-vulnerability matching and installed-package malware scanning are
  removed from the JS engine, its MCP catalog, audit result, evidence snapshot
  and packaged tests.
• Dependency integrity, lockfile drift and typosquat evidence remain local.
• refresh_advisories, scan_dependency_vulnerabilities and
  scan_dependency_malware now belong exclusively to weavatrix-online.

Full Changelog: https://github.com/sergii-ziborov/weavatrix-js/commits/v0.3.15