chore(release): v1.5.0

Bump root + board to 1.5.0 and cut the CHANGELOG [1.5.0] section (all
pre-merge-hardening and audit-follow-up changes), per the merge plan for the
feat-fixes branch.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: andreibesleaga

CHANGELOG.md

@@ -6,11 +6,17 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [1.5.0] - 2026-06-16
+
 ### Pre-merge hardening pass (audit follow-up)
-- **Container image CVEs**: `Dockerfile` now runs `apk upgrade --no-cache` in both
-  stages (self-heals base-image openssl/musl/zlib CVEs at build time) and pins
-  `glob >= 10.5.0` via `overrides` — clears the fixable CRITICAL/HIGH the new Trivy
-  gate flagged.
+- **Container image CVEs** (cleared the new Trivy gate to 0 fixable CRITICAL/HIGH):
+  `Dockerfile` runs `apk upgrade --no-cache` in both stages (self-heals base-image
+  openssl/musl/zlib — incl. a CRITICAL openssl); installs with `npm ci` (lock-faithful,
+  no transitive drift above the audited 0-high lock) and pins `glob >= 10.5.0` via
+  `overrides`; and **removes the bundled npm CLI from the runtime stage** (the node
+  base image's vendored npm shipped HIGH-CVE glob/minimatch/tar that the runtime —
+  which only runs `node` — never uses). Also shrinks the image and reduces attack
+  surface.
 - **Kafka poison-message resilience**: the consumer now skips an unparseable
   (non-JSON) record (logs a warning, advances the offset) instead of throwing and
   crash-looping on it — matching the BullMQ path's tolerance.

board/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "kaiban-distributed-board",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "private": true,
   "description": "Modern React board visualisation for kaiban-distributed — real-time agent & task visualisation via Socket.io",
   "author": "Andrei Besleaga",

board/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kaiban-distributed",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Kaiban Distributed: Distributed Agentic AI Platform - Actor Model Kanban Framework Implementation with Enterprise Messaging Layer State (Redis/Kafka) and Individual Deployed AI Nodes (TypeScript).",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",