Release Ouroboros v1.5.0 #minor

[den-sq]

Summary

• bump desktop and Python package versions to 1.5.0
• pin Neuroglancer v1.1.1 and autoseg v0.4.0-beta.2 CPU/CUDA release assets
• make release installs lockfile-driven, refresh the Node lock, and add a strict audit gate for the patched React Router v7 false-positive
• update GitHub Actions to current Node 24-compatible releases

Validation

• npm run typecheck
• non-mutating ESLint check (0 errors; existing formatting warnings remain)
• npm run build
• npm run audit:release
• 169 Python tests; 99% helper coverage
• Poetry wheel and sdist build
• MkDocs build
• core, CPU-plugin, and CUDA-plugin Linux AppImage/deb/snap builds; embedded manifests checked
• Docker server image build and HTTP smoke test (/, /step-names)

Known follow-ups

• Electron Builder still warns about the inherited unset Linux desktopName
• Docker image dependency resolution is not yet lockfile-backed

[tavateva]

APPROVE — clean, complete, correctly-scoped v1.4.1→v1.5.0 release, and the cross-repo gate is satisfied.

For a release PR the review is completeness + the plugin-pin integrity, and both hold:

• App version → 1.5.0 in package.json (both the top-level and packages[""] fields) and python/pyproject.toml; #minor is the right bump from 1.4.1.
• Plugin pins move consistently everywhere: Neuroglancer v1.0.1 → v1.1.1 and autoseg v0.4.0-beta.1 → v0.4.0-beta.2 (CPU and CUDA assets) across the workflow input defaults, the workflow env (OUROBOROS_*_PLUGIN_TAG), production-package-flavors.md, and technical-constants.md — no surface left behind. A tree-wide grep found zero stale v1.0.1 / beta.1 / 1.4.1 references.
• The build-time gate passes. This release downloads the pinned plugin assets during the build, so the real risk is a pin to an unpublished release. Both are live: neuroglancer-plugin v1.1.1 (published 15:32 UTC, neuroglancer-plugin-v1.1.1.zip present) and ouroboros_autoseg_plugin v0.4.0-beta.2 (published 13:51 UTC, both CPU/CUDA assets present) — verified via the release API, non-draft, assets attached.
• The audit gate is the right shape. validate-npm-audit.mjs allowlists exactly one advisory (GHSA-qwww-vcr4-c8h2, the React Router false positive) for exactly react-router/react-router-dom at exactly the patched 7.18.2, and fails for any other advisory or resolved version — a narrow triple-keyed exception, not a blanket audit disable. The lockfile pins both packages to 7.18.2, so the exception is real and self-limiting.
• The −2028 is lockfile churn, not content loss: package-lock.json is +612/−1974 (the Node lock refresh / React-Router dedup), everything else is small.

CI is green on the four reported checks (docs, coverage, server-image, test-coverage); the desktop AppImage/deb/snap + plugin-flavor builds and the Docker HTTP smoke are release-time/local per the body, which is the normal shape for this repo. The two "Known follow-ups" (the inherited Electron desktopName warning and Docker deps not yet lockfile-backed) are honestly surfaced and neither blocks a release.

Nice closure on the chain: this pins exactly the two plugin releases just reviewed (neuroglancer-plugin#14, ouroboros_autoseg_plugin#53), and the pins match the actually-published tags and asset names. Clear to merge-and-tag.

Limit: reviewed via the diff, a fresh clone for the stale-reference grep, and the release API for asset verification; the desktop/Docker builds are CI/local authority, not re-run here.