chore(release): prepare v0.3.0-preview.15 core preview

[Maneek21]

This prepares the next core preview from the fixes already accepted on the demo. It includes durable sessions and credential revocation, safe native-create retries, note recovery, calendar and attachment fixes, App authority checks, and backup/process recovery. Production runtime source matches the accepted demo apart from the release-version fallback.

The release contract now selects core explicitly. It retains security, image, upgrade, and bundle regression gates while making no Hermes runtime certification claim. Existing installations must use the backup-first upgrade path through schema preview.29.

Public guidance distinguishes published preview.14, the upcoming preview.15 candidate, experimental Apps, and planned capabilities. It separates personal MCP permissions from governed employee actions, documents the required App flags and keyrings, and supplies matching authoring versions and setup paths. Candidate notes remain visibly unreleased until publication.

The automation lifecycle test now configures its required flags before imports and supplies matching database-complete test keyrings to the production runtime. The setup is isolated to that test process; production defaults and lifecycle assertions are unchanged.

Validation:

• Local workspace build, typecheck, web lint, and dependency audit passed before the documentation/test-fixture batch.
• 69 focused checks passed locally, with one Windows-skipped signal case subsequently passing on Linux CI.
• Release contracts (22), bundle regressions (8), and 76 changed-document local links passed; the fixture flag/keyring check also passed locally.
• Final revision 57a6ba7c08581203e5d329217f377fd4bf6c2108 passed Type Check, Test API, Build, Versioned Upgrade, Production Image + Browser Smoke, CodeQL, Dependency Audit, and Dependency Review. API: 1,352 passed, zero failed, 12 skipped. The Linux signal check passed. Hermes certification is intentionally excluded by core scope.
• Existing demo browser and source-correspondence evidence is carried forward. No soak, Hermes runtime certification, independent newcomer authoring, or signed-artifact verification is claimed.

The mobile Apps fix in #317 and Tiptap dependency update in #318 are included. Website changes are staged separately; this PR does not deploy the website or publish a release.