docs(releases): curate the 15.1 line — What's new in 15.1.0 + QA test plan

Fold the 15.1.0 minor into the v15 release page under a "What's new in 15.1.0"
running section (per docs/releases-maintenance.md cadence: minors fold into the
current major page, no new page). Covers, from the 65 changesets + objectui 14.1
Console range bundled at .objectui-sha b8967495be73:

- Behavior changes with migrations: tenancy.strategy/crossTenantAccess removal
  (#2962), ObjectOS→Kernel spec rename (#2963), uniform anonymous-deny (#2567),
  server-enforced readonly/readonlyWhen (#2948/#3042), owner_id anchor guard
  (#3004/#2982), MCP ai.exposed gate (#2964), declarative stdio deny-by-default
  (#3055), OWD authoring gate (#3050), attachment field removals + auth downloads.
- Security hardening sweep (#2849 class: #2980/#2981/#2850/#3022/#2909/#2974).
- New capabilities: attachments v1, declarative connectors (ADR-0096/0097),
  dashboard-level filters (#2501), pinyin search (#3027), conditional tabs,
  aggregate_records MCP tool, official Docker image, kernel:bootstrapped,
  ADR-0087 protocol completion, honest capability discovery.
- Console (objectui 14.1) section + a per-release upgrade checklist.

Also add docs/plans/release-15.1-test-plan.md (the browser/API/automation test
matrix used for release QA; tracking issue #3072).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: os-zhuang