release(0.1.5): bump versions, finalize CHANGELOG, fail loud on missing platform binaries (R20, Z2)

Versions bumped to 0.1.5 in every authoritative location:

- workspace `Cargo.toml` (`[workspace.package].version`, the
  `wickra-core` path dependency pin).
- `bindings/python/pyproject.toml`.
- `bindings/node/package.json` (main + all six `optionalDependencies`
  pins).
- All six per-platform `bindings/node/npm/<target>/package.json`
  templates.

CHANGELOG: the accumulated `[Unreleased]` block is promoted to
`[0.1.5] - TBD` (date left for the user to set at tag time); the new
`[Unreleased]` header sits empty above it; the compare link table is
extended with `[0.1.5]: …compare/v0.1.4...v0.1.5` and the
`[Unreleased]` link is repointed to `…compare/v0.1.5...HEAD`.

Wiki refresh for 0.1.5 (R20 + Z2):

- `Home.md` version pin table updated; the Quickstart-Node hint replaces
  the "spam filter holding back Windows" caveat with "0.1.5 is the
  first release in which `npm install wickra` works end-to-end on
  Windows" (npm Support released the name on 2026-05-22).
- `Quickstart-Node.md`'s Windows caveat is rewritten to explain the
  history (`0.1.1`–`0.1.4` of `wickra-win32-x64-msvc` are burned) and
  the resolution (0.1.5+ installs cleanly).
- `Quickstart-Rust.md` version mention bumped.
- `Warmup-Periods.md` note bumped + corrected: every Node and WASM
  class — single- and multi-output — now exposes `warmupPeriod()` after
  R3 (this branch), not only the single-output ones.

`release.yml` `publish_dir` no longer silently swallows a
second-attempt platform-package publish failure with a `::warning::`
and `return 0`. A real failure (after the existing 30s retry) now
emits an `::error::` and fails the job. The original mask is exactly
what allowed the `wickra-win32-x64-msvc@0.1.1–0.1.4` spam-filter
rejections to land four times in a row without anyone noticing (audit
finding R20). Failing loud means the next regression of this shape is
caught at the release run, not by a Windows user trying to
`require('wickra')`.

This commit does NOT push, tag, or trigger a release — the user
publishes the 0.1.5 tag themselves once the manual npm-republish
smoke test confirms `wickra-win32-x64-msvc@0.1.5` accepts publish on
the freshly-released name.

.github/workflows/release.yml

@@ -228,10 +228,16 @@ jobs:
         working-directory: bindings/node
         run: npx napi artifacts --dir artifacts
 
-      # Publish each platform package individually so one failure doesn't kill
-      # the others. Skip versions that are already on npm. Tolerate spam-filter
-      # 403s with a one-time retry after a short delay (spam detection is
-      # often rate-limit-based and clears on the next request).
+      # Publish each platform package individually. Skip versions that are
+      # already on npm. A first-attempt 403 from npm's spam filter is
+      # tolerated for a single 30-second retry — that historically clears
+      # rate-limit-driven false positives. Anything that still fails after
+      # the retry is a *real* failure (the platform binary will be missing
+      # from `optionalDependencies` and Windows-style installs will break,
+      # exactly the regression that produced audit finding R20) — fail the
+      # job loudly so the release does not silently land in a half-published
+      # state. Previously this loop swallowed the second-attempt failure with
+      # a `::warning::` and `return 0`; that mask is removed.
       - name: Publish platform packages (idempotent)
         working-directory: bindings/node
         env:
@@ -239,6 +245,7 @@ jobs:
         run: |
           set +e
           version=$(node -p "require('./package.json').version")
+          fail=0
           publish_dir() {
             local dir=$1
             local pkg=$(basename "$dir")
@@ -264,13 +271,15 @@ jobs:
               rc=$?
             fi
             if [ "$rc" -ne 0 ]; then
-              echo "::warning::$pkgname could not be published; the main package will skip the missing optional dep"
+              echo "::error::$pkgname could not be published — the release would land with a missing platform binary; failing the job."
+              return 1
             fi
             return 0
           }
           for dir in npm/*/; do
-            publish_dir "$dir"
+            publish_dir "$dir" || fail=1
           done
+          exit $fail
 
       - name: Publish main package to npm (idempotent)
         working-directory: bindings/node