[samgbafa]

Release 1.25.15, cut from main b67ebe0 as is. #493 and #494 are not in it; they go in 1.25.16.

Hand-written bump, per docs/releasing.md and #488: release-plz cannot compute a version here (TC-342), so the release PR #477 (0.0.1 -> 1.25.14, changelog-only) is stale and not used.

Changes in this release since v1.25.14 (5ce5e0d):

• Policy v3: same CORS as /invoke #490 Policy v3: same CORS as /invoke (TC-2192). The only change to an HTTP surface.
• fix(threshold): bound raw combine inputs #491 bound raw combine inputs (TC-2219), tinycloud-threshold only.
• Check certificate-core vectors; Details: TC-2223 #489 certificate-core vector checker (TC-2223), test tooling only.
• feat(threshold): add genesis DKG over owner-closed rounds; Details: TC-2220 #492 threshold genesis DKG (TC-2220), tinycloud-threshold only; no route, tinycloud-node does not depend on the crate.
• ci: split the workspace test job and cache the PR Docker build #495 CI split and Docker PR build cache, workflows only.

Diff: version in tinycloud-node-server/Cargo.toml, the tinycloud-node entry in Cargo.lock and test/m1-realdata-e2e/Cargo.lock (1.25.14 -> 1.25.15), and the CHANGELOG.md section.

Merging this push to main triggers release-plz, which tags v1.25.15 on the merge commit, and that tag push builds the images and the cargo-dist release. Nothing deploys; deploy-phala is a manual workflow_dispatch only.