v1.5.1

What changed

0860f7b release: v1.5.1
96d96be docs: RELEASE.md — release policy (when + how + post-tag verification)
df61507 docs: cross-link contributors/hacking/disclaimer back to the README
76c2ede docs: give the ponytail Range-probe deferral a scheduled revisit trigger
e0097ea refactor: drop dead menu_multi_flag stub, EOF comment; trim sanitize comment
f2a01c1 refactor: dedupe sanitize, menu_multi_flag, season_count; drop dead guards
5f88a32 deps: make yt-dlp a first-class dependency in every package manifest
9987c9f docs: reflect provider fallback, dub default, release CI, -D -e, update paths
5456e37 fix: anime picker row->episode mapping, _stage_ok JSON/plain errors
9a92ddd ci+docs: shell-matrix tests, release pin verification, audit cadence
b1be339 chore: bump packaged versions to master
9f95be3 ci: pkg-bump checks out master — tag pushes put it on a detached HEAD, so git-auto-commit-action exited 128 and the v1.5.0 pins never applied
29d51de fix: validate -n before dependency checks
51295a5 ci: run self-checks on push/PR (sh tests/*.sh + sh -n)
753020b test: self-checks for pop_m3u8 stamping, -e narrowing, and arg validation
d692555 fix: address 15 audit findings (issues #6-#12, #14-#16, #18-#22)