release: 2.15.0: server-dmarc-hint, upstream-tls-verify

The server's own name gets a DMARC record on Settings and Health, and an
inbound domain's upstream a Verified TLS mode (Postfix secure, with
Debian's CA bundle). Migration 0014; schema 14. The pins (compose, README,
guide), the guide's backup example, the planned cuts and the two roadmap
rows. No tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,11 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+## [2.15.0] - 2026-10-18
+
+The two proposals the security audit left as product choices. Migration
+0014; schema 14.
+
 ### Added
 
 - **Verified TLS to an inbound domain's upstream** (upstream-tls-verify; the