[philipgreat]

Part of #10. This PR only pins the package and lockfile version to 2.0.15. It does not publish to crates.io or create a release tag.

Current source and package gates

• Main source d30f30a: generated-workspace fixes from PR Qualify expression policy on freshly generated workspaces #11, with green PR and main CI.
• Candidate source 0eb0366: only Cargo.toml/Cargo.lock version changes relative to main.
• cargo fmt -- --check; cargo test --locked (53/53); cargo clippy --locked --all-targets -- -D warnings; cargo audit (zero vulnerabilities, two allowed warnings); cargo package --locked: PASS.
• Exact stable cargo-teaql 2.0.15 published only to isolated loopback TeaQL Registry, then installed by a source-independent Cargo home. Uploaded/downloaded .crate SHA-256: 07752692e3e6dba22656ad4dd3512934172e60bf6d1a835b3127d1f1b3dc4f2f.
• The installed candidate replayed W1/W2 twice: 64/64 matching expected outcomes. Retained conformance evidence: evidence/2026-10-17-workspace-expression-policy-w4-prep-gate-1/.

W4 remains open until signed provenance, exact public-package installation and retained replay pass. W5 delivery adoption is separate.