docs(release): v1.5.0 notes

[pedromvgomes]

Release notes for v1.5.0, covering pipeline.{ci,cd}.stage_permissions (#58).

Follows the convention that the release-notes commit is the tagged commit, so merging this is what v1.5.0 gets cut from — then v1 moves.

What the notes cover

• Why the baseline was a ceiling. A called workflow can only narrow what its caller grants, so a leaf needing security-events: write had no way to ask for it.
• Why the failure it prevents is silent. wardnet's SARIF upload and registry cache export don't fail the job when the permission is missing — they just stop happening, on a green pipeline. That's the framing the notes lead with, because it's the reason the feature exists rather than a nice-to-have.
• Why the scope vocabulary is enumerated. GitHub ignores an unknown scope silently, so code-scanning: write would render a job that reads as widened, passes review, and fails later at the one call it was meant to permit.

The section worth reading before tagging

## Upgrading differs from v1.4.0, which needed nothing per repository. This one leaves every orchestrator drifted by a three-line comment change, so it wants a gt repo fleet sync. The notes state that up front with the exact diff rather than leaving it to be discovered when gt repo check goes red across the fleet.

The claim that nothing else moves is verified, not asserted: rendering every managed file on v1.4.0 and on this release and diffing with comments stripped leaves both orchestrators byte-identical.

Also recorded

Two things learned building #58 that the next template change will hit:

• gt governs itself, so an orchestrator-template edit must re-render gt's own ci-orchestration.yml in the same PR or the governance stage fails.
• An unversioned dev build refuses to sync a v1-rendered repo rather than repointing it at @v0. Build with -ldflags "-X main.version=vX.Y.Z" when rendering.

Not included

The pnpm/action-setup bump (#57) also landed since v1.4.0. Left out deliberately — v1.4.0's notes likewise covered the substantive change rather than enumerating every commit.

[github-actions]

bulwark

• ✅ scan — no findings

• ✅ coverage — go: 76.8% (baseline 76.8%)

📦 Full bulwark output — complete scan and coverage logs.