v5.15.6 - CodeQL auth-first transport fix, ClawHub scan follow-up

CodeQL 184, 185, 186 (js/user-controlled-bypass, lib/swarm-transport.ts): the envelope-shape check ran before HMAC verification, so request-controlled fields decided whether a request reached verifySigned(). Not exploita

Security

• CodeQL #184, #185, #186 (js/user-controlled-bypass, lib/swarm-transport.ts): the envelope-shape check ran before HMAC verification, so request-controlled fields decided whether a request reached verifySigned(). Not exploitable (that branch only rejected requests), but SwarmTransportServer now authenticates first: with a shared secret configured, signature, freshness, and replay checks run right after JSON parsing, before any envelope or allowlist branch, and non-object bodies are rejected.

ClawHub skill (5.15.5 scan follow-up)

• Removed the contradictory pip install filelock advice; locking is built in (fcntl on Unix, atomic lock-marker file on Windows).
• Corrected "five" to six scripts; token-expiry wording now matches behavior (validate_token.py rejects expired grants; removal is a manual --cleanup).
• New filesystem_operations capability and blackboard.py header declare deletions and archival.
• check_permission.py docstrings state its permission-gating scope and name the abstract resource labels.

Tests

3,740 tests across 41 suites; tsc --noEmit clean; local HOL plugin-scanner 95/100.

Full changelog: https://github.com/Jovancoding/Network-AI/compare/v5.15.5...v5.15.6