Release v1.5.1: qualify, upload evidence, and publish #1056

v1.5.1 kickoff evidence was exported from exact clean main ba72ac986ab3d24e1c5ace2fbcdcc9e4aed97aaa and uploaded to codemower.com through the stored codex-code-mower profile.

• Privacy boundary: metadata-only board_snapshot; 1 event, 0 reports.
• Excluded: source, diffs, model transcripts, stdout/stderr, auth probe output, and secrets.
• Health/token/bundle/model-provenance checks: PASS.
• Stored receipt: HTTP 200, accepted 1, duplicate 0, upload ID 9312736d-4ccb-4ee4-b7e8-7a9fd8274252.
• The receipt reported aggregate refresh stale; this proves storage only. A fresh authenticated dashboard observation remains required separately in Release v1.5.1: qualify, upload evidence, and publish #1056.

Release preparation PR #1061 merged after exact-head Claude PASS, Code Mower gate PASS, Python 3.12–3.14 CI, Board qualification, wheel rehearsal, and containment checks all passed.

• Release merge SHA: e6fc0b147df3097e61f52a99b621d49a0e9aecc7
• Immutable candidate run: https://github.com/codemower-ai/code-mower/actions/runs/35501057283
• Candidate dispatch verified main still equaled the release merge SHA.
• Slack telemetry remains scheduled for v1.6.0; v1.5.1 retains the basic Slack lifecycle only.

Next gates: retained-artifact verification, exact-candidate install/upgrade and feature qualification, bounded hosted Board canary #951, final metadata-only codemower.com upload/dashboard verification, tag, no-publish workflow, PyPI publication, GitHub Release, and canonical reinstall verification.

v1.5.1 qualification and publication are complete.

• Release PR: Release: prepare v1.5.1 reliability candidate #1061
• Accepted commit and tag target: e6fc0b147df3097e61f52a99b621d49a0e9aecc7
• Immutable candidate: run 35501057283
• Wheel SHA-256: add824ee30ae876f241735f6db2cc555ff2afbf7965e3967a753b86d76cf6818
• Sdist SHA-256: 3df09b53c7aa6d49115d1fc795f15d7d365d1d0830ffdbe452b9b7bdc18e8a75
• No-publish verification: run 35503451446
• Production PyPI publication: run 35503489456
• Release-event verification: run 35503544167, green after binding CODE_MOWER_CANDIDATE_RUN_ID to the qualified candidate
• GitHub Release: v1.5.1
• PyPI: code-mower 1.5.1

GitHub and PyPI wheel/sdist downloads matched the retained candidate byte-for-byte. A fresh isolated install from the public PyPI index reported both CLI and package metadata version 1.5.1. The checkout-free orchestrator doctor passed 22/22 checks. Safe-init dry-run, Board doctor, persistent Board service binding, release integrity, and basic Slack qualification passed; the managed Board serves 1.5.1 with an empty owner queue.

The bounded hosted canary is closed in #951/#945. The metadata-only codemower.com upload was accepted as upload 13b960e7-106d-46ca-b903-cc10653970b0; a separate authenticated dashboard load showed the Sep 20 09:47 UTC upload. Aggregate analytics were still recovering at observation time, without affecting the stored upload receipt.

Slack telemetry remains explicitly deferred to v1.6.0 in #921 and #978.