chore: bump --version to 1.1.15 + TODO audit (retire shipped entries)

[click0]

Summary

Two housekeeping commits on the designated branch (no production code):

1. chore(version): bump --version string to 1.1.15 (5d60cdd)
2. docs(TODO): retire completed entries — rootless, hub scheduling, pkg-only update (0c1ab79)

Both bring project metadata in line with what has actually shipped through the 1.1.12 → 1.1.15 series.

---

1. Version bump (5d60cdd)

cli/args.cpp:756, 767 still printed crate 1.1.11 while CHANGELOG.md heads at [1.1.15]. The convention here is to bump the literal at release-cut time rather than per-feature PR, so the gap accumulated across the series. Bumped both --version / -V branches to crate 1.1.15.

Also refreshed the two stale "Applies to: 1.1.11" / "Reasoning about isolation on 1.1.11" sentences in docs/trust-model.{md,uk.md} — the doc body was updated throughout the series to describe the 1.1.12 → 1.1.15 gates, so the opening line now matches: 1.1.15 (rootless model + per-tenant authz series 1.1.12 → 1.1.15 …).

Code comments like // 1.1.11: send a signal … stay — those are historical landed-in markers, not the current version literal.

2. TODO audit (0c1ab79)

An audit of TODO/TODO2 against main found three entries describing already-shipped work as open or in-progress:

• "Rootless containers (in progress on 0.9.x)" — the entire planned arc shipped months ago: verb taxonomy (0.9.0) → wire format (0.9.1) → handlers (0.9.2–0.9.7) → per-user namespacing (0.9.8) → flag flip (0.9.9) → setuid removal (1.0.0). The 80-line "What the refactor needs: … ~3-5 days / ~1 week …" planning block was actively misleading about project state. Replaced with a Done entry that also records the 1.1.12–1.1.15 authorize-before-dispatch extension and points at docs/trust-model.md.
• "Hub scheduling" sat in the open Medium-priority section while its own text said Shipped end-to-end (0.8.40 + 0.8.43). Moved to Done.
• "crate update --pkg-only (partial)" conflated the shipped pkg path (0.8.41) with the open base-system update. Split: shipped half → Done; the open half is now its own Medium-priority entry with the snapshot-and-rollback shape sketched (clone → verify → promote-or-rollback; warm-template-cache and restart-policy interactions noted).

Also backfilled the Done list (which stopped at 0.8.21/0.8.37) with the 1.1.10–1.1.15 arrivals: devfs/signal_jail privops verbs, the in-jail Wayland compositor, the on-hardware validation runbook, and the -lnv link fix + lite-CI link smoke.

Net effect: every remaining open entry in TODO (full base-system update, layered images, getpeereid full refactor) and TODO2 (bhyve backend A) describes genuinely-open work. TODO2 needed no changes — its statuses were accurate.

Test plan

• grep "crate 1\.1\." cli/args.cpp → both branches print crate 1.1.15.
• TODO structure verified post-edit: no dangling references to the removed entries; section headers intact.
• FreeBSD lite CI links crate(1) (the fix(build): -lnv for FreeBSD nvpair API + lite CI link smoke + getpeereid design notes #215 smoke step) — the version-string change is a pure literal; TODO/docs changes don't reach the compiler.

https://claude.ai/code/session_01X6t6tzVypHye5bDGLxzmZK